[Snyk] Upgrade: vue, axios, core-js, dotenv by tufstraka · Pull Request #193 · tufstraka/BFR

tufstraka · 2024-09-21T10:22:08Z

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

vue
from 2.6.12 to 2.7.16 | 41 versions ahead of your current version | 9 months ago
on 2023-12-24
axios
from 1.6.8 to 1.7.6 | 10 versions ahead of your current version | 22 days ago
on 2024-08-30
core-js
from 3.37.0 to 3.38.1 | 3 versions ahead of your current version | a month ago
on 2024-08-20
dotenv
from 16.0.3 to 16.4.5 | 17 versions ahead of your current version | 7 months ago
on 2024-02-20

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Server-side Request Forgery (SSRF) SNYK-JS-AXIOS-7361793	761	Proof of Concept

Release notes

Package name: vue

2.7.16 - 2023-12-24
2.7.16-beta.2 - 2023-12-14
2.7.16-beta.1 - 2023-12-08
2.7.15 - 2023-10-23
2.7.14 - 2022-11-09
2.7.13 - 2022-10-14
2.7.12 - 2022-10-12
2.7.11 - 2022-10-11
2.7.10 - 2022-08-23
2.7.9 - 2022-08-19
2.7.8 - 2022-07-22
2.7.7 - 2022-07-16
2.7.6 - 2022-07-15
2.7.5 - 2022-07-13
2.7.4 - 2022-07-08
2.7.3 - 2022-07-06
2.7.2 - 2022-07-05
2.7.1 - 2022-07-04
2.7.0 - 2022-07-01
2.7.0-beta.8 - 2022-06-28
2.7.0-beta.7 - 2022-06-27
2.7.0-beta.6 - 2022-06-26
2.7.0-beta.5 - 2022-06-22
2.7.0-beta.4 - 2022-06-21
2.7.0-beta.3 - 2022-06-20
2.7.0-beta.2 - 2022-06-17
2.7.0-beta.1 - 2022-06-17
2.7.0-alpha.12 - 2022-06-16
2.7.0-alpha.11 - 2022-06-16
2.7.0-alpha.10 - 2022-06-16
2.7.0-alpha.9 - 2022-06-16
2.7.0-alpha.8 - 2022-06-14
2.7.0-alpha.7 - 2022-06-14
2.7.0-alpha.6 - 2022-06-09
2.7.0-alpha.5 - 2022-06-06
2.7.0-alpha.4 - 2022-06-01
2.7.0-alpha.3 - 2022-06-01
2.7.0-alpha.2 - 2022-06-01
2.7.0-alpha.1 - 2022-05-31
2.6.14 - 2021-06-07
2.6.13 - 2021-06-01
2.6.12 - 2020-08-20

from vue GitHub release notes

Package name: axios

1.7.6 - 2024-08-30
Release notes:

Bug Fixes
- fetch: fix content length calculation for FormData payload; (#6524) (085f568)
- fetch: optimize signals composing logic; (#6582) (df9889b)
Contributors to this release
1.7.5 - 2024-08-23
Release notes:

Bug Fixes
- adapter: fix undefined reference to hasBrowserEnv (#6572) (7004707)
- core: add the missed implementation of AxiosError#status property; (#6573) (6700a8a)
- core: fix ReferenceError: navigator is not defined for custom environments; (#6567) (fed1a4b)
- fetch: fix credentials handling in Cloudflare workers (#6533) (550d885)
Contributors to this release
1.7.4 - 2024-08-13
Release notes:

Bug Fixes
- sec: CVE-2024-39338 (#6539) (#6543) (6b6b605)
- sec: disregard protocol-relative URL to remediate SSRF (#6539) (07a661a)
Contributors to this release
- Lev Pachmanov
- Đỗ Trọng Hải
1.7.3 - 2024-08-01
Release notes:

Bug Fixes
- adapter: fix progress event emitting; (#6518) (e3c76fc)
- fetch: fix withCredentials request config (#6505) (85d4d0e)
- xhr: return original config on errors from XHR adapter (#6515) (8966ee7)
Contributors to this release
1.7.2 - 2024-05-21
Release notes:

Bug Fixes
- fetch: enhance fetch API detection; (#6413) (4f79aef)
Contributors to this release
- Dmitriy Mozgovoy
1.7.1 - 2024-05-20
Release notes:

Bug Fixes
- fetch: fixed ReferenceError issue when TextEncoder is not available in the environment; (#6410) (733f15f)
Contributors to this release
- Dmitriy Mozgovoy
1.7.0 - 2024-05-19
Release notes:

Features
- adapter: add fetch adapter; (#6371) (a3ff99b)
Bug Fixes
- core/axios: handle un-writable error stack (#6362) (81e0455)
Contributors to this release
1.7.0-beta.2 - 2024-05-19
Release notes:

Bug Fixes
- fetch: capitalize HTTP method names; (#6395) (ad3174a)
- fetch: fix & optimize progress capturing for cases when the request data has a nullish value or zero data length (#6400) (95a3e8e)
- fetch: fix headers getting from a stream response; (#6401) (870e0a7)
Contributors to this release
- Dmitriy Mozgovoy
1.7.0-beta.1 - 2024-05-07
Release notes:

Bug Fixes
- core/axios: handle un-writable error stack (#6362) (81e0455)
- fetch: fix cases when ReadableStream or Response.body are not available; (#6377) (d1d359d)
- fetch: treat fetch-related TypeError as an AxiosError.ERR_NETWORK error; (#6380) (bb5f9a5)
Contributors to this release
- Alexandre ABRIOUX
- Dmitriy Mozgovoy
Install
```
npm i axios@next
```
1.7.0-beta.0 - 2024-04-28
Release notes:

Features
- adapter: add fetch adapter; (#6371) (a3ff99b)
Contributors to this release
- Dmitriy Mozgovoy
- Jay
Install
```
npm i axios@next
```
1.6.8 - 2024-03-15

from axios GitHub release notes

Package name: core-js

3.38.1 - 2024-08-20
- Changes v3.38.0...v3.38.1
- Fixed some cases of URLSearchParams percent decoding, #1357, #1361, thanks @ slowcheetah
- Some stylistic changes and minor optimizations
- Compat data improvements:
  - Iterator helpers proposal methods marked as shipped from FF131
  - Math.f16round and DataView.prototype.{ getFloat16, setFloat16 } marked as shipped from Bun 1.1.23
  - RegExp.escape marked as shipped from Bun 1.1.22
  - Promise.try marked as shipped from Bun 1.1.22
  - Uint8Array to / from base64 and hex proposal methods marked as shipped from Bun 1.1.22
  - Added Hermes 0.13 compat data, similar to React Native 0.75 Hermes
  - Added Opera Android 84 compat data mapping
3.38.0 - 2024-08-04
- Changes v3.37.1...v3.38.0
- RegExp.escape proposal:
  - Built-ins:
    - RegExp.escape
  - Moved to stage 3, June 2024 and July 2024 TC39 meetings
  - Updated the way of escaping, regex-escaping/77
  - Throw an error on non-strings, regex-escaping/58
  - Added /actual/ namespace entries, unconditional forced replacement changed to feature detection
- Promise.try proposal:
  - Built-ins:
    - Promise.try
  - Moved to stage 3, June 2024 TC39 meeting
  - Added /actual/ namespace entries, unconditional forced replacement changed to feature detection
- Uint8Array to / from base64 and hex stage 3 proposal:
  - Built-ins:
    - Uint8Array.fromBase64
    - Uint8Array.fromHex
    - Uint8Array.prototype.setFromBase64
    - Uint8Array.prototype.setFromHex
    - Uint8Array.prototype.toBase64
    - Uint8Array.prototype.toHex
  - Added Uint8Array.prototype.{ setFromBase64, setFromHex } methods
  - Added Uint8Array.fromBase64 and Uint8Array.prototype.setFromBase64 lastChunkHandling option, proposal-arraybuffer-base64/33
  - Added Uint8Array.prototype.toBase64 omitPadding option, proposal-arraybuffer-base64/60
  - Added throwing a TypeError on arrays backed by detached buffers
  - Unconditional forced replacement changed to feature detection
- Fixed RegExp named capture groups polyfill in combination with non-capturing groups, #1352, thanks @ Ulop
- Improved some cases of environment detection
- Uses process.getBuiltinModule for getting built-in NodeJS modules where it's available
- Uses https instead of http in URL constructor feature detection to avoid extra notifications from some overly vigilant security scanners, #1345
- Some minor optimizations
- Updated browserslist in core-js-compat dependencies that fixes an upstream issue with incorrect interpretation of some browserslist queries, #1344, browserslist/829, browserslist/836
- Compat data improvements:
  - Added Safari 18.0 compat data:
  - Math.f16round and DataView.prototype.{ getFloat16, setFloat16 } marked as shipped from FF129
  - Symbol.asyncDispose added and marked as supported from V8 ~ Chromium 127
  - Promise.try added and marked as supported from V8 ~ Chromium 128
  - Added Deno 1.44 and 1.45 compat data mapping
  - self descriptor is broken in Deno 1.45.3 (again)
  - Added Electron 32 and 33 compat data mapping
  - Added Opera Android 83 compat data mapping
  - Added Samsung Internet 27 compat data mapping
  - Added Oculus Quest Browser 34 compat data mapping
3.37.1 - 2024-05-14
- Changes v3.37.0...v3.37.1
- Fixed URL.parse feature detection for some specific cases
- Compat data improvements:
  - Set methods proposal added and marked as supported from FF 127
  - Symbol.dispose added and marked as supported from V8 ~ Chromium 125
  - Math.f16round and DataView.prototype.{ getFloat16, setFloat16 } added and marked as supported from Deno 1.43
  - URL.parse added and marked as supported from Chromium 126
  - URL.parse added and marked as supported from NodeJS 22.0
  - URL.parse added and marked as supported from Deno 1.43
  - Added Rhino 1.7.15 compat data, many features marked as supported
  - Added NodeJS 22.0 compat data mapping
  - Added Deno 1.43 compat data mapping
  - Added Electron 31 compat data mapping
  - Updated Opera Android 82 compat data mapping
  - Added Samsung Internet 26 compat data mapping
  - Added Oculus Quest Browser 33 compat data mapping
3.37.0 - 2024-04-16
- Changes v3.36.1...v3.37.0
- New Set methods proposal:
  - Built-ins:
    - Set.prototype.intersection
    - Set.prototype.union
    - Set.prototype.difference
    - Set.prototype.symmetricDifference
    - Set.prototype.isSubsetOf
    - Set.prototype.isSupersetOf
    - Set.prototype.isDisjointFrom
  - Moved to stable ES, April 2024 TC39 meeting
  - Added es. namespace modules, /es/ and /stable/ namespaces entries
- Explicit Resource Management stage 3 proposal
  - Some minor updates like explicit-resource-management/217
- Added Math.sumPrecise stage 2.7 proposal:
  - Built-ins:
    - Math.sumPrecise
- Promise.try proposal:
  - Built-ins:
    - Promise.try
  - Added optional arguments support, promise-try/16
  - Moved to stage 2.7, April 2024 TC39 meeting
- RegExp.escape stage 2 proposal:
  - Moved to hex-escape semantics, regex-escaping/67
    - It's not the final change of the way of escaping, waiting for regex-escaping/77 soon
- Pattern matching stage 1 proposal:
  - Built-ins:
    - Symbol.customMatcher
  - Once again, the used well-known symbol was renamed
  - Added new entries for that
- Added Extractors stage 1 proposal:
  - Built-ins:
    - Symbol.customMatcher
  - Since the Symbol.customMatcher well-known symbol from the pattern matching proposal is also used in the exactors proposal, added an entry also for this proposal
- Added URL.parse, url/825
- Engines bugs fixes:
  - Added a fix of Safari { Object, Map }.groupBy bug that does not support iterable primitives
  - Added a fix of Safari bug with double call of constructor in Array.fromAsync
- Compat data improvements:
  - URL.parse added and marked as supported from FF 126
  - URL.parse added and marked as supported from Bun 1.1.4
  - URL.canParse fixed and marked as supported from Bun 1.1.0
  - New Set methods fixed in JavaScriptCore and marked as supported from Bun 1.1.1
  - Added Opera Android 82 compat data mapping

from core-js GitHub release notes

Package name: dotenv

from dotenv GitHub release notes

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade: - vue from 2.6.12 to 2.7.16. See this package in npm: https://www.npmjs.com/package/vue - axios from 1.6.8 to 1.7.6. See this package in npm: https://www.npmjs.com/package/axios - core-js from 3.37.0 to 3.38.1. See this package in npm: https://www.npmjs.com/package/core-js - dotenv from 16.0.3 to 16.4.5. See this package in npm: https://www.npmjs.com/package/dotenv See this project in Snyk: https://app.snyk.io/org/kadimakeith/project/b8e8a269-157d-48b1-b50e-2c3f048e60c5?utm_source=github&utm_medium=referral&page=upgrade-pr

netlify · 2024-09-21T10:22:28Z

❌ Deploy Preview for biasedfilmreview failed. Why did it fail? →

Name	Link
🔨 Latest commit	`e0dde6e`
🔍 Latest deploy log	https://app.netlify.com/sites/biasedfilmreview/deploys/66ee9e53584dd60008b912c0

Conversation

tufstraka commented Sep 21, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Features

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Install

Release notes:

Features

Contributors to this release

Install

Uh oh!

netlify bot commented Sep 21, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for biasedfilmreview failed. Why did it fail? →

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

netlify bot commented Sep 21, 2024 •

edited

Loading