Skip to content

[Snyk] Fix for 35 vulnerabilities#738

Open
adamlaska wants to merge 1 commit intomasterfrom
snyk-fix-0c9ac32c9c42a88e962b62dd41be648e
Open

[Snyk] Fix for 35 vulnerabilities#738
adamlaska wants to merge 1 commit intomasterfrom
snyk-fix-0c9ac32c9c42a88e962b62dd41be648e

Conversation

@adamlaska
Copy link
Copy Markdown
Owner

snyk-top-banner

Snyk has created this PR to fix 35 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

  • packages/bitcore-build/package.json
  • packages/bitcore-build/package-lock.json
  • packages/bitcore-build/.snyk

Vulnerabilities that will be fixed with an upgrade:

Issue Score
high severity Prototype Pollution
SNYK-JS-LODASH-567746
  731  
medium severity Improper Handling of Unicode Encoding
SNYK-JS-TAR-15038581
  713  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-DIFF-14917201
  708  
high severity Command Injection
SNYK-JS-GLOB-14040952
  706  
high severity Excessive Platform Resource Consumption within a Loop
SNYK-JS-BRACES-6838727
  696  
high severity Denial of Service (DoS)
SNYK-JS-DECODEURICOMPONENT-3149970
  696  
high severity Prototype Pollution
SNYK-JS-LODASH-6139239
  696  
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795
  696  
medium severity Directory Traversal
SNYK-JS-TAR-15032660
  693  
high severity Prototype Pollution
SNYK-JS-INI-1048974
  686  
high severity Prototype Pollution
SNYK-JS-LODASH-608086
  686  
high severity Code Injection
SNYK-JS-LODASH-1040724
  681  
medium severity Symlink Attack
SNYK-JS-TMP-11501554
  661  
medium severity Uncontrolled Resource Consumption ('Resource Exhaustion')
SNYK-JS-TAR-6476909
  646  
high severity Arbitrary File Write
SNYK-JS-TAR-1579147
  639  
high severity Arbitrary File Write
SNYK-JS-TAR-1579152
  639  
high severity Arbitrary File Write
SNYK-JS-TAR-1579155
  639  
medium severity Missing Release of Resource after Effective Lifetime
SNYK-JS-INFLIGHT-6095116
  631  
medium severity Prototype Pollution
SNYK-JS-LODASH-15053838
  631  
high severity Arbitrary File Overwrite
SNYK-JS-TAR-1536528
  624  
high severity Arbitrary File Overwrite
SNYK-JS-TAR-1536531
  624  
medium severity Prototype Pollution
SNYK-JS-MINIMIST-559764
  601  
medium severity Prototype Pollution
SNYK-JS-YARGSPARSER-560381
  601  
medium severity Directory Traversal
SNYK-JS-TAR-15127355
  596  
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MOCHA-2863123
  589  
high severity Prototype Pollution
SNYK-JS-UNSETVALUE-2400660
  589  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905
  586  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905
  586  
medium severity Prototype Pollution
SNYK-JS-JSYAML-13961110
  559  
low severity Prototype Pollution
SNYK-JS-MINIMIST-2429795
  506  
low severity Regular Expression Denial of Service (ReDoS)
npm:debug:20170905
  506  
medium severity Inefficient Regular Expression Complexity
SNYK-JS-MICROMATCH-6838728
  479  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818
  479  
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BRACEEXPANSION-9789073
  436  
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-TAR-1536758
  410  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Command Injection
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn

…age-lock.json & packages/bitcore-build/.snyk to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-TAR-15038581
- https://snyk.io/vuln/SNYK-JS-DIFF-14917201
- https://snyk.io/vuln/SNYK-JS-GLOB-14040952
- https://snyk.io/vuln/SNYK-JS-BRACES-6838727
- https://snyk.io/vuln/SNYK-JS-DECODEURICOMPONENT-3149970
- https://snyk.io/vuln/SNYK-JS-LODASH-6139239
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://snyk.io/vuln/SNYK-JS-TAR-15032660
- https://snyk.io/vuln/SNYK-JS-INI-1048974
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-TMP-11501554
- https://snyk.io/vuln/SNYK-JS-TAR-6476909
- https://snyk.io/vuln/SNYK-JS-TAR-1579147
- https://snyk.io/vuln/SNYK-JS-TAR-1579152
- https://snyk.io/vuln/SNYK-JS-TAR-1579155
- https://snyk.io/vuln/SNYK-JS-INFLIGHT-6095116
- https://snyk.io/vuln/SNYK-JS-LODASH-15053838
- https://snyk.io/vuln/SNYK-JS-TAR-1536528
- https://snyk.io/vuln/SNYK-JS-TAR-1536531
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
- https://snyk.io/vuln/SNYK-JS-TAR-15127355
- https://snyk.io/vuln/SNYK-JS-MOCHA-2863123
- https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-JSYAML-13961110
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/npm:debug:20170905
- https://snyk.io/vuln/SNYK-JS-MICROMATCH-6838728
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
- https://snyk.io/vuln/SNYK-JS-BRACEEXPANSION-9789073
- https://snyk.io/vuln/SNYK-JS-TAR-1536758


The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
@google-cla
Copy link
Copy Markdown

google-cla Bot commented Feb 11, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants