Skip to content

[Snyk] Security upgrade luxon from 2.4.0 to 2.5.2#25

Open
snyk-bot wants to merge 1 commit intodevelopfrom
snyk-fix-641d4d9fc12c8931d8a9c0984dd0187a
Open

[Snyk] Security upgrade luxon from 2.4.0 to 2.5.2#25
snyk-bot wants to merge 1 commit intodevelopfrom
snyk-fix-641d4d9fc12c8931d8a9c0984dd0187a

Conversation

@snyk-bot
Copy link
Contributor

@snyk-bot snyk-bot commented Jan 6, 2023

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 658/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3
Regular Expression Denial of Service (ReDoS)
SNYK-JS-LUXON-3225081
No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: luxon The new version differs by 11 commits.
  • 204cdfe fix rfc2822 regex & bump to 2.5.2
  • 4817697 bump to 2.5.0
  • 00f1d72 fix changelog
  • eebc657 Add support for ESM-style node imports (#1218)
  • f1c181c Update why.md (#1211)
  • 4332730 mention escaping behavior in Duration.toFormat docstring (#1221)
  • 7b4a9d0 Bump parse-url from 6.0.0 to 6.0.2 (#1230)
  • 60c83c7 Fix link to duration months (#1232)
  • c7e606b Wednesday support for RFC 850 (#1225)
  • 6b47f20 fix luxon path in api-docs script (#1214)
  • bf7127d Increase number of allowed digits when parsing ISO duration (#1213)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

@sonarqubecloud
Copy link

sonarqubecloud bot commented Jan 6, 2023

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
0.0% 0.0% Duplication

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant