Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Security upgrade simple-git from 1.95.0 to 3.3.0 #26

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 691/1000
Why? Recently disclosed, Has a fix available, CVSS 8.1
Command Injection
SNYK-JS-SIMPLEGIT-2421199
Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: simple-git The new version differs by 250 commits.
  • 94c2462 Merge pull request #768 from steveukx/changeset-release/main
  • 9113366 Version Packages
  • 372efa0 Merge pull request #767 from steveukx/feat/fix-fetch-snyk
  • d119ec4 Prevent use of `--upload-pack` as a command in `git.fetch` to avoid potential accidental command execution.
  • e4ff627 Merge pull request #761 from steveukx/changeset-release/main
  • fcc7618 Version Packages
  • 7c24bb0 Merge pull request #760 from steveukx/fix/project-readme
  • 80651d5 Remove pre-publish step of copying `readme.md`, no longer required
  • 0d0c198 Merge pull request #759 from steveukx/changeset-release/main
  • 6838e24 Version Packages
  • d53875f Merge pull request #758 from steveukx/fix/project-readme
  • ac4f38f Move workspace readme into the `simple-git` package, symlink to it from the workspace
  • e9f0461 Move workspace readme into the `simple-git` package, symlink to it from the workspace
  • bcfa6f8 Merge pull request #756 from steveukx/changeset-release/main
  • 7a29566 Version Packages
  • 50a8a6b Merge pull request #755 from steveukx/release-attempt
  • d35987b Add publish goal to changeset action
  • 5073eaa Merge pull request #754 from steveukx/changeset-release/main
  • c4f937d Version Packages
  • e9abd5d Merge pull request #753 from steveukx/release-attempt
  • 1e4c591 Removes the auto-deletion of changesets branches
  • 284f896 Merge pull request #752 from steveukx/changeset-release/main
  • c486165 Version Packages
  • 79ec4e4 Merge pull request #751 from steveukx/release-attempt

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant