From a52998e541bc8b8155c6f4890395576fb6b2bf9c Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Thu, 30 Apr 2020 22:18:05 -0700 Subject: [PATCH 1/2] fix: package.json & .snyk to reduce vulnerabilities The following vulnerabilities are fixed with a Snyk patch: - https://snyk.io/vuln/SNYK-JS-LODASH-567746 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 949951f..bc394db 100644 --- a/package.json +++ b/package.json @@ -26,7 +26,7 @@ "jsonwebtoken": "^8.1.0", "route-parser": "0.0.5", "slugify": "^1.2.6", - "snyk": "^1.69.10" + "snyk": "^1.316.1" }, "snyk": true } From 3c2bbbe9c9df2bd076e50498a8d46b845e50b856 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Thu, 30 Apr 2020 22:18:06 -0700 Subject: [PATCH 2/2] fix: package.json & .snyk to reduce vulnerabilities The following vulnerabilities are fixed with a Snyk patch: - https://snyk.io/vuln/SNYK-JS-LODASH-567746 --- .snyk | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/.snyk b/.snyk index 6205333..c50f677 100644 --- a/.snyk +++ b/.snyk @@ -1,16 +1,22 @@ # Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. -version: v1.12.0 +version: v1.14.1 # ignores vulnerabilities until expiry date; change duration by modifying expiry date ignore: 'npm:chownr:20180731': - bcrypt > node-pre-gyp > tar > chownr: expires: '2018-10-14T14:59:55.757Z' - '@google-cloud/datastore > google-gax > grpc > node-pre-gyp > tar > chownr': - reason: '' - expires: '2018-11-22T18:34:44.794Z' - '@google-cloud/datastore > google-gax > grpc > node-pre-gyp > tar > chownr': expires: '2018-10-14T14:59:55.757Z' - bcrypt > node-pre-gyp > tar > chownr: + - '@google-cloud/datastore > google-gax > grpc > node-pre-gyp > tar > chownr': + reason: '' + expires: '2018-11-22T18:34:44.794Z' + - bcrypt > node-pre-gyp > tar > chownr: reason: '' expires: '2018-11-22T18:34:44.794Z' -patch: {} +# patches apply the minimum changes required to fix a vulnerability +patch: + SNYK-JS-LODASH-567746: + - '@google-cloud/datastore > google-gax > lodash': + patched: '2020-05-01T05:18:00.906Z' + - '@google-cloud/datastore > google-gax > @grpc/proto-loader > lodash': + patched: '2020-05-01T05:18:00.906Z'