[Snyk] Fix for 1 vulnerabilities #175

posrix · 2023-06-21T18:54:05Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- packages/@vue/cli/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: execa

The new version differs by 168 commits.

e98561a 2.1.0
c6a24ec Add `error.originalMessage` property (service-worker.js error vuejs/vue-cli#373)
f9bd317 Upgrade cross-spawn to 7.0.0 (some css code will disappear when I build the project vuejs/vue-cli#367)
f620305 Document the reasons why the returned promise might fail (EventSource's response has a MIME type ("text/event") that is not "text/event-stream". Aborting the connection. vuejs/vue-cli#364)
7c19345 Revert "Add a sentence about job search (transition无过度效果 vuejs/vue-cli#293)" (debug info is confusing in chrome 在chrome浏览器下调试信息错乱但在火狐下正常 vuejs/vue-cli#352)
48067c4 Properly clean up child processes created during tests (vue-cli升级webpack到2.x以后vue-router的懒加载方式不能被支持了 vuejs/vue-cli#349)
603537a 2.0.5
d268fd1 Make execa compatible with Node.js 13.0.0-pre (Loader Utils Deprecation Warning - webpack vuejs/vue-cli#370)
ac2bc15 2.0.4
211febe Fix errors being thrown when `detached: true` or `cleanup: false` is used (Cannot load any css and js file after build? vuejs/vue-cli#360)
0cdc62c 2.0.3
aa070b8 Add missing `result.all` TypeScript definition (Feature Request: Custom Configs vuejs/vue-cli#345)
b46cba1 Fix test for Node `>= 12.6.0` (Fix function name typo vuejs/vue-cli#348)
19e58fe Separate `process.env`-related logic to its own function (Extract local path logic and add tests. vuejs/vue-cli#341)
c9b4d09 Readme tweaks (关于mac系统vue-cli下载的模板依赖不全的问题 vuejs/vue-cli#340)
82d2a4a Add tip on how to execute the current package's binary (Creating a vue file with vue-cli vuejs/vue-cli#339)
8977752 2.0.2
6a8e9ac Do not read streams more than once (build path issue vuejs/vue-cli#330)
7d51047 Move `onExit()` cleanup code next to `onExit()` (Extraneous instruction when generating in the current directory vuejs/vue-cli#337)
0241d6e Improve tests for the `timeout` option (npm run dev error vuejs/vue-cli#332)
2a7551f Refactor the `timeout` option (Minor Bug: router/index.js needs repositioning of import vuejs/vue-cli#333)
9020f28 Rename `stdioOption` variable (Add complete option vuejs/vue-cli#334)
b336fbf Make the synchronous errors code clearer (Support custom run process vuejs/vue-cli#331)
46daa7b Separate command-related logic into its own file (vue-cli run 'npm run dev' error vuejs/vue-cli#329)

See the full diff

Package name: semver

The new version differs by 168 commits.

e7b78de chore: release 7.5.2
58c791f fix: diff when detecting major change from prerelease (构建优化问题 vuejs/vue-cli#566)
5c8efbc fix: preserve build in raw after inc (fix the vue init error from private repository in window OS vuejs/vue-cli#565)
717534e fix: better handling of whitespace (Add option to run vue-cli through npx vuejs/vue-cli#564)
2f738e9 chore: bump @ npmcli/template-oss from 4.14.1 to 4.15.1 (The current working directory must be exist vuejs/vue-cli#558)
aa016a6 chore: release 7.5.1
d30d25a fix: show type on invalid semver error (ajax get request to data.json which in src folder vuejs/ 8000 vue-cli#559)
09c69e2 chore: bump @ npmcli/template-oss from 4.13.0 to 4.14.1 ('npm install -g vue-cli' error vuejs/vue-cli#555)
5b02ad7 chore: release 7.5.0
e219bb4 fix: throw on bad version with correct error message (vue init doesn't work vuejs/vue-cli#552)
503a4e5 feat: allow identifierBase to be false (V-card-media images are not proccess in the "npm run build" vuejs/vue-cli#548)
fc2f3df fix: incorrect results from diff sometimes with prerelease versions (Prevent vue-cli templating from colliding with vue's own handlebar {{}} template markers vuejs/vue-cli#546)
2781767 fix: avoid re-instantiating SemVer during diff compare (vue webpack - Root file vuejs/vue-cli#547)
82aa7f6 chore: release 7.4.0
731d896 chore: enable CD ('vue init webpack',SyntaxError: Unexpected end of JSON input vuejs/vue-cli#545)
940723d fix: intersects with v0.0.0 and v0.0.0-0 (无法定位外部引入.js 文件里面的对象undefined错误； vuejs/vue-cli#538)
aa516b5 fix: faster parse options (error while installing vue-cli globally vuejs/vue-cli#535)
61e6ea1 fix: faster cache key factory for range (Error during vue init in _stream_transform.js vuejs/vue-cli#536)
f8b8b61 fix: optimistic parse (Vue-cli 怎么用直接上传到sftp上？ vuejs/vue-cli#541)
796cbe2 fix: semver.diff prerelease to release recognition ( how to vue-cli in Multiple pages application? vuejs/vue-cli#533)
3f222b1 fix: reuse comparators on subset (New project built by vue - cli, which can be started after npm run dev, but the hot update can go wrong, please? vuejs/vue-cli#537)
113f513 feat: identifierBase parameter for .inc (vue-cli使用less出错：This relative module was not found vuejs/vue-cli#532)
ea689bc chore: basic type test for RELEASE_TYPES
c5d29df docs: Add "Constants" section to README

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

fix: packages/@vue/cli/package.json to reduce vulnerabilities

f598c50

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

posrix mentioned this pull request May 13, 2024

[Snyk] Security upgrade vue-cli-plugin-apollo from 0.13.9 to 0.22.0 #232

Open

posrix mentioned this pull request May 22, 2024

[Snyk] Fix for 2 vulnerabilities #238

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Snyk] Fix for 1 vulnerabilities #175

[Snyk] Fix for 1 vulnerabilities #175

Uh oh!

Uh oh!

Uh oh!

[Snyk] Fix for 1 vulnerabilities #175

Are you sure you want to change the base?

[Snyk] Fix for 1 vulnerabilities #175

Uh oh!

Conversation

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:

Uh oh!

Uh oh!