Skip to content

[Snyk] Security upgrade gatsby from 2.32.13 to 3.13.0 - #54

Open
dotam99 wants to merge 1 commit into
productionfrom
snyk-fix-2055523b0d28d977e7c217fc4f93ad5d
Open

[Snyk] Security upgrade gatsby from 2.32.13 to 3.13.0#54
dotam99 wants to merge 1 commit into
productionfrom
snyk-fix-2055523b0d28d977e7c217fc4f93ad5d

Conversation

@dotam99

@dotam99 dotam99 commented Mar 22, 2024

Copy link
Copy Markdown
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • developers.cloudflare.com/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 763/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.4
Path Traversal
SNYK-JS-WEBPACKDEVMIDDLEWARE-6476555
Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: gatsby The new version differs by 250 commits.
  • 0a455df chore(release): Publish
  • 91dc167 fix(gatsby): don't log FAST_DEV message for each worker (#32961) (#32967)
  • f936c93 fix(gatsby): set staticQueryResultHash to new hash on data change (#32949) (#32966)
  • ea161ce feat(gatsby-graphiql-explorer): upgrade to webpack 5 ([Turnstile] Pre-clear API requests cloudflare/cloudflare-docs#30642)
  • 944e381 chore(release): Publish next
  • d6326df fix(gatsby-core-utils): Switch `auth` option from got to username/password (#32665)
  • cf9c066 fix(gatsby): add this typings to actions (Cashapp cloudflare/cloudflare-docs#32210)
  • 53aa88e chore: enable test parallelism (#32766)
  • b7deabc fix(deps): update starters and examples - gatsby (#32843)
  • 6025c84 chore(deps): update dependency katex to ^0.13.13 for gatsby-remark-katex (#32567)
  • d87c5cb chore: enable lmdb by default and update node for next major (#32695)
  • 818d6c1 feat(gatsby-plugin-gatsby-cloud): Add `disablePreviewUI` option (#32907)
  • f556a00 chore: update changelogs (#32924)
  • aba5eba feat(gatsby): enable webpack caching in development for everyone (#32922)
  • ac7bd4e feat(gatsby-source-wordpress): allow path to js file for beforeChangeNode option (#32901)
  • 1a87a8a docs(gatsby-source-wordpress): document content sync (#32768)
  • 417df15 chore: re-generate changelogs (#32886)
  • 1810874 fix(gatsby-source-wordpress): draft previews (#32915)
  • 7c72ab8 chore(gatsby): remove unused packages (#32903)
  • afb06d7 chore(docs): Add hint for MDX plugin in remark-plugin-tutorial (#32876)
  • 1303ecb chore(docs): Update wording for "using-web-fonts" (#32902)
  • 9589911 chore(docs): Fix code highlighting in part 6 (#32900)
  • 568d4ce feat(gatsby-source-drupal): Use the collection count from JSON:API extras to enable parallel API requests for cold builds (#32883)
  • 41f5337 fix(deps): update typescript to ^4.29.3 (#32614)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Path Traversal

@guardrails

guardrails Bot commented Mar 22, 2024

Copy link
Copy Markdown

⚠️ We detected 99 security issues in this pull request:

Mode: paranoid | Total findings: 99 | Considered vulnerability: 99

Hard-Coded Secrets (99)
Severity Details Docs
Medium Title: Hex High Entropy String
{ binding = "REDIRECTS", id = "8f79dc3f8f5840e1bde3fce52a67d62e" }
📚
Medium Title: Hex High Entropy String
{ binding = "REDIRECTS", id = "65462db7fc30456593591d0ee0384869" }
📚
Medium Title: Hex High Entropy String
{ binding = "REDIRECTS", id = "8851304780a744369049e4612d5b7132" }
📚
Medium Title: Hex High Entropy String
{ binding = "REDIRECTS", id = "d67abaab47504270a65afcf3f6460f5d" }
📚
Medium Title: Hex High Entropy String
{ binding = "REDIRECTS", id = "6405ea2c8e794feca7b5dfcc5e53875a" }
📚
Medium Title: Hex High Entropy String
{ binding = "REDIRECTS", id = "8a91001065b6459483db0b898a58cd2e" }
📚
Medium Title: Hex High Entropy String
{ binding = "REDIRECTS", id = "f28bd6bb32a84aa0b4827c5dc2466bc1" }
📚
Medium Title: Cloudflare API Token
// Keep in sync with https://github.com/cloudflare/cloudflare-docs-engine/blob/ea2031c9575f7785ec9356963fd9cf6e00d2c379/src/components/mdx/directory-listing.js
📚
Medium Title: Cloudflare API Token
1. Ensure you’re running node version `>=12.0.0`, as [specified by Docs Engine](https://github.com/cloudflare/cloudflare-docs-engine/blob/765bc30127b0e80b570aade7044036925928c3ea/package.json#L50).
📚
Medium Title: Cloudflare API Token
4. Run the engine’s [`bootstrap` command](https://github.com/cloudflare/cloudflare-docs-engine/blob/765bc30127b0e80b570aade7044036925928c3ea/bin/commands.sh#L19-L39):
📚
Medium Title: Cloudflare API Token
This guide is for contributors to [@cloudflare/cloudflare-docs](https://github.com/cloudflare/cloudflare-docs). To review the full contribution guidelines, see [Contributing to Cloudflare's Documentation](https://github.com/cloudflare/cloudflare-docs/blob/186d17204a509d4c8514b4c4dafd00974b4713b8/CONTRIBUTING.md).
📚
Medium Title: Cloudflare API Token
Search is powered by Algolia DocSearch and [must be configured](/reference/configuration) in `docs-config.js`. Make a PR on [@algolia/docsearch-configs](https://github.com/algolia/docsearch-configs/pull/2300) to obtain an `indexName` and `apiKey` (e.g. see the [Workers PR](https://github.com/algolia/docsearch-configs/pull/2300)). Then simply set those values as `search.indexName` and `search.apiKey` (e.g. see the [Workers config](https://github.com/cloudflare/cloudflare-docs/blob/e72247549d20f649786251d0368de19560d1bbb2/products/workers/docs-config.js#L21-L24)). To disable search, set those values to the empty string (e.g. [Docs Engine example site](https://github.com/adamschwartz/docs-engine-example/blob/6d725ffa554454e1daa4c0d2a8a7e44408056e6b/docs-config.js#L21-L24)).
📚
Medium Title: Cloudflare API Token
However, these files can also be placed inside any sub-folder of your project. When doing this, you’ll need to then customize the `contentRepoFolder` property in `docs-config.js`, which is how the [products inside @cloudflare/cloudflare-docs](https://github.com/cloudflare/cloudflare-docs/tree/production/products) are all set up, e.g. the [Workers product](https://github.com/cloudflare/cloudflare-docs/blob/1efd366c25bc1bdd1a40f7bc4737310c6b00d15e/products/workers/docs-config.js#L6).
📚
Medium Title: Cloudflare API Token
The `search` field is used to add a search to the site, powered by Algolia DocSearch. To hide search, set `search.indexName` and `search.apiKey` to the empty string, as in the example above. For an example of a project using search, see the [Workers config](https://github.com/cloudflare/cloudflare-docs/blob/e72247549d20f649786251d0368de19560d1bbb2/products/workers/docs-config.js#L21-L24).
📚
Medium Title: Cloudflare API Token
- By default the engine assumes that a docs site’s structure is placed in the root of a project repo. However, this whole structure can also be placed inside any sub-folder by setting this property. For example, this site’s content is inside the [`products/docs-engine` folder](https://github.com/cloudflare/cloudflare-docs/tree/4fd3a4af9507b20bb23fea4d7c4f4cd349c0f463/products/docs-engine) of [@cloudflare/cloudflare-docs](https://github.com/cloudflare/cloudflare-docs) so its `"products/docs-engine"`.
📚
Medium Title: Cloudflare API Token
For an example of a project using search, see the [Workers config](https://github.com/cloudflare/cloudflare-docs/blob/e72247549d20f649786251d0368de19560d1bbb2/products/workers/docs-config.js#L21-L24).
📚
Medium Title: Cloudflare API Token
In the [Workers docs](https://developers.cloudflare.com/workers), there’s a partial used in the intro of all of the [Tutorials](https://developers.cloudflare.com/workers/tutorials), called “Before you start” which makes sure folks have the appropriate pre-requisites before starting a Workers tutorial ([source](https://github.com/cloudflare/cloudflare-docs/blob/4ba1e70d2a535c93ef6de42b0fc5178dabdb942b/products/workers/src/content/_partials/_tutorials-before-you-start.md)):
📚
Medium Title: Cloudflare API Token
Inside the tutorial it’s imported as you would any other MDX component ([source](https://github.com/cloudflare/cloudflare-docs/blob/4ba1e70d2a535c93ef6de42b0fc5178dabdb942b/products/workers/src/content/tutorials/build-a-qr-code-generator/index.md)):
📚
Medium Title: Cloudflare API Token
You can additional set your own frontmatter props in order to use them as variables inside of your pages. This is how the [Workers “Example” pages](https://github.com/cloudflare/cloudflare-docs/blob/4ba1e70d2a535c93ef6de42b0fc5178dabdb942b/products/workers/src/content/examples/alter-headers.md#L12) are constructed.
📚
Medium Title: Cloudflare API Token
If within a non-document-type page you’d like to have some content constrained by the normal content column, use the [`<ContentColumn/>` component](/reference/markdown#contentcolumn). The Workers Example pages use this component to [constrain the width](https://github.com/cloudflare/cloudflare-docs/blob/4ba1e70d2a535c93ef6de42b0fc5178dabdb942b/products/workers/src/content/examples/respond-with-another-site.md#L10-L22) of descriptive text while allowing the code example to be showcased.
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
"author": "Cloudflare <github@cloudflare.com>",
📚
Medium Title: Cloudflare Email
If you have any questions, please contact your Cloudflare Account Team or [SaaSv2@cloudflare.com](mailto:SaaSv2@cloudflare.com).
📚
Medium Title: Cloudflare Email
To use Cloudflare’s Provisioning API capabilities requires enablement by Cloudflare. Reach out to partners@cloudflare.com for more information.
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.3.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.3.0
📚

More info on how to fix Hard-Coded Secrets in General and JavaScript.


👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants