From 23411e300ea98a8708840c1f1e5ac11e241fd283 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Thu, 22 Nov 2018 01:29:25 +0000 Subject: [PATCH] fix: .snyk & package.json to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/npm:debug:20170905 - https://snyk.io/vuln/npm:minimatch:20160620 - https://snyk.io/vuln/npm:ms:20170412 - https://snyk.io/vuln/npm:qs:20170213 The following vulnerabilities are fixed with a Snyk patch: - https://snyk.io/vuln/npm:debug:20170905 - https://snyk.io/vuln/npm:mime:20170907 - https://snyk.io/vuln/npm:minimatch:20160620 - https://snyk.io/vuln/npm:ms:20170412 - https://snyk.io/vuln/npm:negotiator:20160616 --- .snyk | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++++ package.json | 25 ++++++++++++++++------ 2 files changed, 78 insertions(+), 7 deletions(-) create mode 100644 .snyk diff --git a/.snyk b/.snyk new file mode 100644 index 0000000000..3f7e41218e --- /dev/null +++ b/.snyk @@ -0,0 +1,60 @@ +# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. +version: v1.13.1 +ignore: {} +# patches apply the minimum changes required to fix a vulnerability +patch: + 'npm:debug:20170905': + - gulp-connect > connect > serve-static > send > debug: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > connect > connect-timeout > debug: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > connect > serve-index > debug: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > tiny-lr > body-parser > debug: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > connect > body-parser > debug: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > connect > morgan > debug: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > connect > compression > debug: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > connect > express-session > debug: + patched: '2018-11-22T01:29:23.467Z' + 'npm:mime:20170907': + - gulp-connect > connect > serve-static > send > mime: + patched: '2018-11-22T01:29:23.467Z' + 'npm:minimatch:20160620': + - gulp > vinyl-fs > glob-stream > minimatch: + patched: '2018-11-22T01:29:23.467Z' + - gulp > vinyl-fs > glob-watcher > gaze > globule > minimatch: + patched: '2018-11-22T01:29:23.467Z' + - gulp > vinyl-fs > glob-watcher > gaze > globule > glob > minimatch: + patched: '2018-11-22T01:29:23.467Z' + 'npm:ms:20170412': + - gulp-connect > connect > connect-timeout > ms: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > connect > serve-index > debug > ms: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > connect > morgan > debug > ms: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > connect > compression > debug > ms: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > connect > body-parser > debug > ms: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > connect > connect-timeout > debug > ms: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > tiny-lr > body-parser > debug > ms: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > connect > express-session > debug > ms: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > connect > serve-static > send > ms: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > connect > serve-static > send > debug > ms: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > connect > serve-favicon > ms: + patched: '2018-11-22T01:29:23.467Z' + 'npm:negotiator:20160616': + - gulp-connect > connect > compression > accepts > negotiator: + patched: '2018-11-22T01:29:23.467Z' + - gulp-connect > connect > serve-index > accepts > negotiator: + patched: '2018-11-22T01:29:23.467Z' diff --git a/package.json b/package.json index 0c50f73889..3d48d96cb3 100644 --- a/package.json +++ b/package.json @@ -2,19 +2,22 @@ "description": "Atom docs", "private": true, "dependencies": { - "gulp": "^3.9.0", + "gulp": "^4.0.0", "gulp-coffee": "^2.3.1", "gulp-concat": "^2.6.0", - "gulp-connect": "^2.2.0", + "gulp-connect": "^5.6.1", "gulp-if": "^2.0.0", "gulp-minify-css": "^1.2.1", "gulp-replace": "^0.5.4", "gulp-sass": "^2.0.4", "gulp-uglify": "^1.4.2", - "js-yaml": "^3.4.3" + "js-yaml": "^3.4.3", + "snyk": "^1.110.1" }, "scripts": { - "gulp": "gulp" + "gulp": "gulp", + "snyk-protect": "snyk protect", + "prepare": "npm run snyk-protect" }, "license": "MIT", "repository": { @@ -29,8 +32,16 @@ "gulp-babel": "^6.1.2" }, "standard": { - "ignore": ["javascripts/search_worker.js"], + "ignore": [ + "javascripts/search_worker.js" + ], "parser": "babel-eslint", - "globals": ["$", "importScripts", "lunr", "Worker"] - } + "globals": [ + "$", + "importScripts", + "lunr", + "Worker" + ] + }, + "snyk": true }