Skip to content

[Snyk] Fix for 1 vulnerabilities - #55

Open
dotam99 wants to merge 1 commit into
productionfrom
snyk-fix-6ded45b564e4ea93975722b7c6403b4a
Open

[Snyk] Fix for 1 vulnerabilities#55
dotam99 wants to merge 1 commit into
productionfrom
snyk-fix-6ded45b564e4ea93975722b7c6403b4a

Conversation

@dotam99

@dotam99 dotam99 commented Apr 14, 2024

Copy link
Copy Markdown
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • developers.cloudflare.com/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 501/1000
Why? Recently disclosed, Has a fix available, CVSS 4.3
Information Exposure Through Sent Data
SNYK-JS-PHIN-6598077
Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: gatsby-plugin-sharp The new version differs by 250 commits.
  • c1e67a2 chore(release): Publish
  • 0c45654 chore: remove tracedSVG (#37093) (#37137)
  • d7edf95 chore(release): Publish
  • 2d00ea0 fix(gatsby-plugin-mdx): Do not leak frontmatter into page (#35859) (#35913)
  • 4997d63 chore(release): Publish
  • ff94ed5 fix(gatsby-plugin-mdx): don't allow JS frontmatter by default (#35830) (#35834)
  • 36f21b0 chore: Removate validate-renovate from v3-latest branch (#34460)
  • 1acb1bc chore(release): Publish
  • 1589bd8 fix(gatsby): ensure that writing node manifests to disk does not break on Windows (#33853) (#34020)
  • 9694010 fix(gatsby-source-drupal): Ensure all new nodes are created before creating relationships (#33864) (#34019)
  • 76deb39 fix(gatsby-source-drupal): searcParams missing from urls (#33861) (#34018)
  • f74cc8f feat(gatsby-source-drupal): Add node manifest support for previews (#33683) (#34017)
  • 476a591 chore(release): Publish
  • 35b48f8 fix(gatsby-plugin-image): GatsbyImage not displaying image in IE11 (#33416) (#33806)
  • 880022e fix(gatsby-plugin-image): flickering when state changes (#33732) (#33807)
  • c0d07e7 feat(gatsby-source-wordpress): Update supported-remote-plugin-versions.ts (#33801) (#33804)
  • 3d9a702 chore(release): Publish
  • 84053a2 fix(gatsby-plugin-sharp): pass input buffer instead of readStream when processing image jobs (#33685) (#33703)
  • 4722a0d fix(gatsby-source-drupal): Add timeout in case of stalled API requests (#33668) (#33705)
  • 857a628 fix(gatsby): single page node manifest accuracy (#33642) (#33698)
  • 6bfd0f1 Properly set the pathPrefix and assetPrefix in the pluginData (#33667) (#33702)
  • 26c51c0 fix(gatsby-source-drupal): cache backlink records (#33444) (#33701)
  • b80c53a fix(gatsby-source-drupal): Correctly update nodes with changed back references so queries are re-run (#33328) (#33699)
  • e29a194 chore: use gatsby-dev-cli@latest-v3 in tests

See the full diff

Package name: gatsby-remark-images The new version differs by 250 commits.
  • c1e67a2 chore(release): Publish
  • 0c45654 chore: remove tracedSVG (#37093) (#37137)
  • d7edf95 chore(release): Publish
  • 2d00ea0 fix(gatsby-plugin-mdx): Do not leak frontmatter into page (#35859) (#35913)
  • 4997d63 chore(release): Publish
  • ff94ed5 fix(gatsby-plugin-mdx): don't allow JS frontmatter by default (#35830) (#35834)
  • 36f21b0 chore: Removate validate-renovate from v3-latest branch (#34460)
  • 1acb1bc chore(release): Publish
  • 1589bd8 fix(gatsby): ensure that writing node manifests to disk does not break on Windows (#33853) (#34020)
  • 9694010 fix(gatsby-source-drupal): Ensure all new nodes are created before creating relationships (#33864) (#34019)
  • 76deb39 fix(gatsby-source-drupal): searcParams missing from urls (#33861) (#34018)
  • f74cc8f feat(gatsby-source-drupal): Add node manifest support for previews (#33683) (#34017)
  • 476a591 chore(release): Publish
  • 35b48f8 fix(gatsby-plugin-image): GatsbyImage not displaying image in IE11 (#33416) (#33806)
  • 880022e fix(gatsby-plugin-image): flickering when state changes (#33732) (#33807)
  • c0d07e7 feat(gatsby-source-wordpress): Update supported-remote-plugin-versions.ts (#33801) (#33804)
  • 3d9a702 chore(release): Publish
  • 84053a2 fix(gatsby-plugin-sharp): pass input buffer instead of readStream when processing image jobs (#33685) (#33703)
  • 4722a0d fix(gatsby-source-drupal): Add timeout in case of stalled API requests (#33668) (#33705)
  • 857a628 fix(gatsby): single page node manifest accuracy (#33642) (#33698)
  • 6bfd0f1 Properly set the pathPrefix and assetPrefix in the pluginData (#33667) (#33702)
  • 26c51c0 fix(gatsby-source-drupal): cache backlink records (#33444) (#33701)
  • b80c53a fix(gatsby-source-drupal): Correctly update nodes with changed back references so queries are re-run (#33328) (#33699)
  • e29a194 chore: use gatsby-dev-cli@latest-v3 in tests

See the full diff

Package name: gatsby-transformer-sharp The new version differs by 250 commits.
  • c1e67a2 chore(release): Publish
  • 0c45654 chore: remove tracedSVG (#37093) (#37137)
  • d7edf95 chore(release): Publish
  • 2d00ea0 fix(gatsby-plugin-mdx): Do not leak frontmatter into page (#35859) (#35913)
  • 4997d63 chore(release): Publish
  • ff94ed5 fix(gatsby-plugin-mdx): don't allow JS frontmatter by default (#35830) (#35834)
  • 36f21b0 chore: Removate validate-renovate from v3-latest branch (#34460)
  • 1acb1bc chore(release): Publish
  • 1589bd8 fix(gatsby): ensure that writing node manifests to disk does not break on Windows (#33853) (#34020)
  • 9694010 fix(gatsby-source-drupal): Ensure all new nodes are created before creating relationships (#33864) (#34019)
  • 76deb39 fix(gatsby-source-drupal): searcParams missing from urls (#33861) (#34018)
  • f74cc8f feat(gatsby-source-drupal): Add node manifest support for previews (#33683) (#34017)
  • 476a591 chore(release): Publish
  • 35b48f8 fix(gatsby-plugin-image): GatsbyImage not displaying image in IE11 (#33416) (#33806)
  • 880022e fix(gatsby-plugin-image): flickering when state changes (#33732) (#33807)
  • c0d07e7 feat(gatsby-source-wordpress): Update supported-remote-plugin-versions.ts (#33801) (#33804)
  • 3d9a702 chore(release): Publish
  • 84053a2 fix(gatsby-plugin-sharp): pass input buffer instead of readStream when processing image jobs (#33685) (#33703)
  • 4722a0d fix(gatsby-source-drupal): Add timeout in case of stalled API requests (#33668) (#33705)
  • 857a628 fix(gatsby): single page node manifest accuracy (#33642) (#33698)
  • 6bfd0f1 Properly set the pathPrefix and assetPrefix in the pluginData (#33667) (#33702)
  • 26c51c0 fix(gatsby-source-drupal): cache backlink records (#33444) (#33701)
  • b80c53a fix(gatsby-source-drupal): Correctly update nodes with changed back references so queries are re-run (#33328) (#33699)
  • e29a194 chore: use gatsby-dev-cli@latest-v3 in tests

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

@guardrails

guardrails Bot commented Apr 14, 2024

Copy link
Copy Markdown

⚠️ We detected 99 security issues in this pull request:

Mode: paranoid | Total findings: 99 | Considered vulnerability: 99

Hard-Coded Secrets (99)
Severity Details Docs
Medium Title: Hex High Entropy String
{ binding = "REDIRECTS", id = "8f79dc3f8f5840e1bde3fce52a67d62e" }
📚
Medium Title: Hex High Entropy String
{ binding = "REDIRECTS", id = "65462db7fc30456593591d0ee0384869" }
📚
Medium Title: Hex High Entropy String
{ binding = "REDIRECTS", id = "8851304780a744369049e4612d5b7132" }
📚
Medium Title: Hex High Entropy String
{ binding = "REDIRECTS", id = "d67abaab47504270a65afcf3f6460f5d" }
📚
Medium Title: Hex High Entropy String
{ binding = "REDIRECTS", id = "6405ea2c8e794feca7b5dfcc5e53875a" }
📚
Medium Title: Hex High Entropy String
{ binding = "REDIRECTS", id = "8a91001065b6459483db0b898a58cd2e" }
📚
Medium Title: Hex High Entropy String
{ binding = "REDIRECTS", id = "f28bd6bb32a84aa0b4827c5dc2466bc1" }
📚
Medium Title: Cloudflare API Token
// Keep in sync with https://github.com/cloudflare/cloudflare-docs-engine/blob/ea2031c9575f7785ec9356963fd9cf6e00d2c379/src/components/mdx/directory-listing.js
📚
Medium Title: Cloudflare API Token
1. Ensure you’re running node version `>=12.0.0`, as [specified by Docs Engine](https://github.com/cloudflare/cloudflare-docs-engine/blob/765bc30127b0e80b570aade7044036925928c3ea/package.json#L50).
📚
Medium Title: Cloudflare API Token
4. Run the engine’s [`bootstrap` command](https://github.com/cloudflare/cloudflare-docs-engine/blob/765bc30127b0e80b570aade7044036925928c3ea/bin/commands.sh#L19-L39):
📚
Medium Title: Cloudflare API Token
This guide is for contributors to [@cloudflare/cloudflare-docs](https://github.com/cloudflare/cloudflare-docs). To review the full contribution guidelines, see [Contributing to Cloudflare's Documentation](https://github.com/cloudflare/cloudflare-docs/blob/186d17204a509d4c8514b4c4dafd00974b4713b8/CONTRIBUTING.md).
📚
Medium Title: Cloudflare API Token
Search is powered by Algolia DocSearch and [must be configured](/reference/configuration) in `docs-config.js`. Make a PR on [@algolia/docsearch-configs](https://github.com/algolia/docsearch-configs/pull/2300) to obtain an `indexName` and `apiKey` (e.g. see the [Workers PR](https://github.com/algolia/docsearch-configs/pull/2300)). Then simply set those values as `search.indexName` and `search.apiKey` (e.g. see the [Workers config](https://github.com/cloudflare/cloudflare-docs/blob/e72247549d20f649786251d0368de19560d1bbb2/products/workers/docs-config.js#L21-L24)). To disable search, set those values to the empty string (e.g. [Docs Engine example site](https://github.com/adamschwartz/docs-engine-example/blob/6d725ffa554454e1daa4c0d2a8a7e44408056e6b/docs-config.js#L21-L24)).
📚
Medium Title: Cloudflare API Token
However, these files can also be placed inside any sub-folder of your project. When doing this, you’ll need to then customize the `contentRepoFolder` property in `docs-config.js`, which is how the [products inside @cloudflare/cloudflare-docs](https://github.com/cloudflare/cloudflare-docs/tree/production/products) are all set up, e.g. the [Workers product](https://github.com/cloudflare/cloudflare-docs/blob/1efd366c25bc1bdd1a40f7bc4737310c6b00d15e/products/workers/docs-config.js#L6).
📚
Medium Title: Cloudflare API Token
The `search` field is used to add a search to the site, powered by Algolia DocSearch. To hide search, set `search.indexName` and `search.apiKey` to the empty string, as in the example above. For an example of a project using search, see the [Workers config](https://github.com/cloudflare/cloudflare-docs/blob/e72247549d20f649786251d0368de19560d1bbb2/products/workers/docs-config.js#L21-L24).
📚
Medium Title: Cloudflare API Token
- By default the engine assumes that a docs site’s structure is placed in the root of a project repo. However, this whole structure can also be placed inside any sub-folder by setting this property. For example, this site’s content is inside the [`products/docs-engine` folder](https://github.com/cloudflare/cloudflare-docs/tree/4fd3a4af9507b20bb23fea4d7c4f4cd349c0f463/products/docs-engine) of [@cloudflare/cloudflare-docs](https://github.com/cloudflare/cloudflare-docs) so its `"products/docs-engine"`.
📚
Medium Title: Cloudflare API Token
For an example of a project using search, see the [Workers config](https://github.com/cloudflare/cloudflare-docs/blob/e72247549d20f649786251d0368de19560d1bbb2/products/workers/docs-config.js#L21-L24).
📚
Medium Title: Cloudflare API Token
In the [Workers docs](https://developers.cloudflare.com/workers), there’s a partial used in the intro of all of the [Tutorials](https://developers.cloudflare.com/workers/tutorials), called “Before you start” which makes sure folks have the appropriate pre-requisites before starting a Workers tutorial ([source](https://github.com/cloudflare/cloudflare-docs/blob/4ba1e70d2a535c93ef6de42b0fc5178dabdb942b/products/workers/src/content/_partials/_tutorials-before-you-start.md)):
📚
Medium Title: Cloudflare API Token
Inside the tutorial it’s imported as you would any other MDX component ([source](https://github.com/cloudflare/cloudflare-docs/blob/4ba1e70d2a535c93ef6de42b0fc5178dabdb942b/products/workers/src/content/tutorials/build-a-qr-code-generator/index.md)):
📚
Medium Title: Cloudflare API Token
You can additional set your own frontmatter props in order to use them as variables inside of your pages. This is how the [Workers “Example” pages](https://github.com/cloudflare/cloudflare-docs/blob/4ba1e70d2a535c93ef6de42b0fc5178dabdb942b/products/workers/src/content/examples/alter-headers.md#L12) are constructed.
📚
Medium Title: Cloudflare API Token
If within a non-document-type page you’d like to have some content constrained by the normal content column, use the [`<ContentColumn/>` component](/reference/markdown#contentcolumn). The Workers Example pages use this component to [constrain the width](https://github.com/cloudflare/cloudflare-docs/blob/4ba1e70d2a535c93ef6de42b0fc5178dabdb942b/products/workers/src/content/examples/respond-with-another-site.md#L10-L22) of descriptive text while allowing the code example to be showcased.
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.2.0
📚
Medium Title: Cloudflare Email
"author": "Cloudflare <github@cloudflare.com>",
📚
Medium Title: Cloudflare Email
If you have any questions, please contact your Cloudflare Account Team or [SaaSv2@cloudflare.com](mailto:SaaSv2@cloudflare.com).
📚
Medium Title: Cloudflare Email
To use Cloudflare’s Provisioning API capabilities requires enablement by Cloudflare. Reach out to partners@cloudflare.com for more information.
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.3.0
📚
Medium Title: Cloudflare Email
uses: cloudflare/wrangler-action@1.3.0
📚

More info on how to fix Hard-Coded Secrets in General and JavaScript.


👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants