Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Security upgrade node-pg-migrate from 3.20.0 to 5.7.0 #32

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 758/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.3
Prototype Pollution
SNYK-JS-Y18N-1021887
Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: node-pg-migrate The new version differs by 250 commits.
  • 71d849e 5.7.0
  • 7aa6af1 Updated changelog
  • 49dba34 `pgm.sql` can also accept `PgLiteral`, `number`, `boolean`, `null`, `array` (#695)
  • 9b72b62 Bump node-fetch from 2.6.0 to 2.6.1 (#689)
  • a6a43c5 Update all non-major dependencies
  • 5783b6f Eslint config (#692)
  • 8decc89 Update dependency yargs to v16 (#691)
  • 74f3664 Update all non-major dependencies
  • 6c8fbb1 Update all non-major dependencies
  • 4d255c5 Update all non-major dependencies
  • f79c1d7 Update dependency typescript to v4 (#682)
  • b0b2b40 Update dependency ts-node to v9 (#681)
  • 8896c95 Update all non-major dependencies
  • 9db481b Using pg client in custom runner test (#679)
  • 47aac05 5.6.0
  • f87992e Updated changelog
  • 05be999 PgLiteral can be serialized (#678)
  • f02fffa 5.5.1
  • f304c83 Updated changelog
  • 813c956 Do not try to unlock DB if connection failed (#677)
  • b8e9594 Update all non-major dependencies Docker tags
  • 84c8220 Update all non-major dependencies
  • 7982295 5.5.0
  • 3742a40 Updated changelog

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant