Skip to content

[Snyk] Upgrade: , , , , , , axios, bootstrap, moment, react-loader-spinner, react-router, react-router-dom, react-scripts, web-vitals #190

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Upgrade: , , , , , , axios, bootstrap, moment, react-loader-spinner, react-router, react-router-dom, react-scripts, web-vitals #190

wants to merge 1 commit into from

Conversation

@irklva
Copy link
Owner

@irklva irklva commented Sep 15, 2024

snyk-top-banner

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name Versions Released on

@fortawesome/fontawesome-svg-core
from 6.4.0 to 6.6.0 | 5 versions ahead of your current version | 2 months ago
on 2024-07-16
@fortawesome/free-solid-svg-icons
from 6.4.0 to 6.6.0 | 5 versions ahead of your current version | 2 months ago
on 2024-07-16
@fortawesome/react-fontawesome
from 0.2.0 to 0.2.2 | 2 versions ahead of your current version | 4 months ago
on 2024-05-22
@reduxjs/toolkit
from 1.9.5 to 1.9.7 | 2 versions ahead of your current version | a year ago
on 2023-10-04
@testing-library/jest-dom
from 5.16.1 to 5.17.0 | 5 versions ahead of your current version | a year ago
on 2023-07-18
@testing-library/react
from 12.1.2 to 12.1.5 | 3 versions ahead of your current version | 2 years ago
on 2022-04-11
axios
from 1.4.0 to 1.7.5 | 20 versions ahead of your current version | 23 days ago
on 2024-08-23
bootstrap
from 5.2.3 to 5.3.3 | 7 versions ahead of your current version | 7 months ago
on 2024-02-20
moment
from 2.29.4 to 2.30.1 | 2 versions ahead of your current version | 9 months ago
on 2023-12-27
react-loader-spinner
from 5.3.4 to 5.4.5 | 1 version ahead of your current version | a year ago
on 2023-08-26
react-router
from 6.2.1 to 6.26.1 | 151 versions ahead of your current version | a month ago
on 2024-08-15
react-router-dom
from 6.2.1 to 6.26.1 | 151 versions ahead of your current version | a month ago
on 2024-08-15
react-scripts
from 5.0.0 to 5.0.1 | 1 version ahead of your current version | 2 years ago
on 2022-04-12
web-vitals
from 2.1.3 to 2.1.4 | 1 version ahead of your current version | 3 years ago
on 2022-01-21

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Cross-site Request Forgery (CSRF)
SNYK-JS-AXIOS-6032459		 676 Proof of Concept
high severity Prototype Pollution
SNYK-JS-AXIOS-6144788		 676 No Known Exploit
high severity Server-side Request Forgery (SSRF)
SNYK-JS-AXIOS-7361793		 676 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-AXIOS-6124857		 676 Proof of Concept
critical severity Incomplete List of Disallowed Inputs
SNYK-JS-BABELTRAVERSE-5962462		 676 Proof of Concept
high severity Improper Input Validation
SNYK-JS-FOLLOWREDIRECTS-6141137		 676 Proof of Concept
high severity Denial of Service (DoS)
SNYK-JS-DECODEURICOMPONENT-3149970		 676 Proof of Concept
medium severity Information Exposure
SNYK-JS-FOLLOWREDIRECTS-6444610		 676 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		 676 No Known Exploit
low severity Prototype Pollution
SNYK-JS-MINIMIST-2429795		 676 Proof of Concept
Release notes
Package name: @fortawesome/fontawesome-svg-core from @fortawesome/fontawesome-svg-core GitHub release notes
Package name: @fortawesome/free-solid-svg-icons from @fortawesome/free-solid-svg-icons GitHub release notes
Package name: @fortawesome/react-fontawesome
  • 0.2.2 - 2024-05-22

    Fixed

    • Props with nullable/undefined values no longer throw an error #562 #560
  • 0.2.1 - 2024-05-16

    Changed

    • Remove defaultProps to be compatible with React 19
  • 0.2.0 - 2022-06-29

    Added

    • Support for React forwardRef if using React >= 16.3
from @fortawesome/react-fontawesome GitHub release notes
Package name: @reduxjs/toolkit
  • 1.9.7 - 2023-10-04

    This bugfix release rewrites the RTKQ hook TS types to significantly improve TS perf.

    Changelog

    RTKQ TS Perf

    A number of users had reported that Intellisense for RTKQ API objects was extremely slow (multiple seconds) - see discussion in #3214 . We did some perf investigation on user-provided examples, and concluded that the biggest factor to slow RTKQ TS perf was the calculation of hook names like useGetPokemonQuery, which was generating a large TS union of types.

    We've rewritten that hook names type calculation to use mapped types and a couple of intersections. In a specific user-provided stress test repo, it dropped TS calculation time by 60% (2600ms to 1000ms).

    There's more potential work we can do to improve things, but this seems like a major perf improvement worth shipping now.

    What's Changed

    Full Changelog: v1.9.6...v1.9.7

  • 1.9.6 - 2023-09-24

    This bugfix release adds a new dev-mode middleware to catch accidentally dispatching an action creator, adds a new listener middleware option around waiting for forks, adds a new option to update provided tags when updateQueryData is used, reworks internal types to better handle uses with TS declaration output, and fixes a variety of small issues.

    Changelog

    Action Creator Dev Check Middleware

    RTK already includes dev-mode middleware that check for the common mistakes of accidentally mutating state and putting non-serializable values into state or actions.

    Over the years we've also seen a semi-frequent error where users accidentally pass an action creator reference to dispatch, instead of calling it and dispatching the action it returns.

    We've added another dev-mode middleware that specifically catches this error and warns about it.

    Additional Options

    The listener middleware's listenerApi.fork() method now has an optional autoJoin flag that can be used to keep the effect from finishing until all active forked tasks have completed.

    updateQueryData now has an updateProvidedTags option that will force a recalculation of that endpoint's provided tags. It currently defaults to false, and we'll likely turn that to true in the next major.

    Other Fixes

    The builder.addCase method now throws an error if a type string is empty.

    fetchBaseQuery now uses an alternate method to clone the original Request in order to work around an obscure Chrome bug.

    The immutability middleware logic was tweaked to avoid a potential stack overflow.

    Types Changes

    The internal type imports have been reworked to try to fix "type portability" issues when used in combination with TS declaration outputs.

    A couple additional types were exported to help with wrapping createAsyncThunk.

    What's Changed

    Full Changelog: v1.9.5...v1.9.6

  • 1.9.5 - 2023-04-18

    This bugfix release includes notable improvements to TS type inference when using the enhancers option in configureStore, and updates the listener middleware to only check predicates if the dispatched value is truly an action object.

    What's Changed

    • update to latest remark-typescript-tools by @ EskiMojo14 in #3311
    • add isAction helper function, and ensure listener middleware only runs for actions by @ EskiMojo14 in #3372
    • Allow inference of enhancer state extensions, and fix inference when using callback form by @ EskiMojo14 in #3207

    Full Changelog: v1.9.4...v1.9.5

from @reduxjs/toolkit GitHub release notes
Package name: @testing-library/jest-dom from @testing-library/jest-dom GitHub release notes
Package name: @testing-library/react from @testing-library/react GitHub release notes
Package name: axios from axios GitHub release notes
Package name: bootstrap
  • 5.3.3 - 2024-02-20

    Highlights

    • Fixed a breaking change introduced with color modes where it was required to manually import variables-dark.scss when building Bootstrap with Sass. Now, _variables.scss will automatically import _variables-dark.scss. If you were already importing _variables-dark.scss manually, you should keep doing it as it won't break anything and will be the way to go in v6.
    • Fixed a regression in the selector engine that wasn't able to handle multiple IDs anymore.

    Color modes

    • Badges now use the .text-bg-* text utilities to be certain that the text is always readable (especially when the customized colors are different in light and dark modes).
    • Fixed our color-modes.js script to handle the case where the OS is set to light mode and the auto color mode is used on the website. If you copied the script from our docs, you should apply this change to your own script.
    • Fixed color schemes description in the color modes documentation to show that color-scheme() only accept light and dark values as parameters.

    Miscellaneous

    • Allowed <dl>, <dt> and <dd> in the sanitizer.
    • Dropped evenly items distribution for modal and offcanvas headers.
    • Fixed the accordion CSS selectors to avoid inheritance issues when nesting accordions.
    • Fixed the focus box-shadow for the validation stated form controls.
    • Fixed the focus ring on focused checked buttons.
    • Fixed the product example mobile navbar toggler.
    • Changed the RTL processing of carousel control icons.

    🎨 CSS

    • #37508: Use child combinators to avoid inheriting parent accordion's flush styles
    • #38719: Fix focus box-shadow for validation stated form-controls
    • #38884: fix border-radius on radio-switch
    • #39294: Tests: update navbar in visual modal test
    • #39373: refactor css: modal and offcanvas header spacing
    • #39380: Fix Sass compilation breaking change in v5.3
    • #39387: docs: fix typo
    • #39411: Optimize the accordion icon
    • #39497: Fix a typo
    • #39536: Changed RTL processing of carousel control icons
    • #39560: Drop --bs-accordion-btn-focus-border-color and deprecate $accordion-button-focus-border-color
    • #39595: CSS: Fix the focus ring on focused checked buttons

    ☕️ JavaScript

    • #39201: Selector Engine: fix multiple IDs
    • #39224: Fix edge case in color-mode.js
    • #39376: Allow dl, dt and dd in sanitizer

    📖 Docs

    • #39200: Typo Fix
    • #39214: Doc: use .text-bg-{color} for all badges
    • #39246: Docs: fix for example code blocks have unnecessary 30px right-margin
    • #39249: Doc: consistent rendering of 'Heads up!' callouts
    • #39281: Fix getOrCreateInstance() doc example
    • #39293: Update background.md
    • #39304: Doc: add expanded accordion explanation
    • #39320: Drop .table-light from table foot example
    • #39340: Doc: add dispose() to Offcanvas methods
    • #39378: Docs: fix sentence in modal
    • #39417: Fix color schemes description in Sass customization documentation
    • #39418: Docs: change vite config path import in vite guide
    • #39435: Docs: add shift-color() usage example in sass customization page
    • #39458: Docs: enhance .card-img-* description
    • #39503: Minor image compression improvements
    • #39519: Docs: use consistent HTML elements in Utilities -> Background page
    • #39520: Docs: drop unused <...

@snyk-bot
fix: upgrade multiple dependencies with Snyk
d787043 
Snyk has created this PR to upgrade:
  - @fortawesome/fontawesome-svg-core from 6.4.0 to 6.6.0.
    See this package in npm: https://www.npmjs.com/package/@fortawesome/fontawesome-svg-core
  - @fortawesome/free-solid-svg-icons from 6.4.0 to 6.6.0.
    See this package in npm: https://www.npmjs.com/package/@fortawesome/free-solid-svg-icons
  - @fortawesome/react-fontawesome from 0.2.0 to 0.2.2.
    See this package in npm: https://www.npmjs.com/package/@fortawesome/react-fontawesome
  - @reduxjs/toolkit from 1.9.5 to 1.9.7.
    See this package in npm: https://www.npmjs.com/package/@reduxjs/toolkit
  - @testing-library/jest-dom from 5.16.1 to 5.17.0.
    See this package in npm: https://www.npmjs.com/package/@testing-library/jest-dom
  - @testing-library/react from 12.1.2 to 12.1.5.
    See this package in npm: https://www.npmjs.com/package/@testing-library/react
  - axios from 1.4.0 to 1.7.5.
    See this package in npm: https://www.npmjs.com/package/axios
  - bootstrap from 5.2.3 to 5.3.3.
    See this package in npm: https://www.npmjs.com/package/bootstrap
  - moment from 2.29.4 to 2.30.1.
    See this package in npm: https://www.npmjs.com/package/moment
  - react-loader-spinner from 5.3.4 to 5.4.5.
    See this package in npm: https://www.npmjs.com/package/react-loader-spinner
  - react-router from 6.2.1 to 6.26.1.
    See this package in npm: https://www.npmjs.com/package/react-router
  - react-router-dom from 6.2.1 to 6.26.1.
    See this package in npm: https://www.npmjs.com/package/react-router-dom
  - react-scripts from 5.0.0 to 5.0.1.
    See this package in npm: https://www.npmjs.com/package/react-scripts
  - web-vitals from 2.1.3 to 2.1.4.
    See this package in npm: https://www.npmjs.com/package/web-vitals

See this project in Snyk:
https://app.snyk.io/org/irklva/project/9941e376-1995-485a-9342-4d36c5bacfa4?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@irklva @snyk-bot