[Snyk] Fix for 2 vulnerabilities by dotam99 · Pull Request #56 · dotam99/cloudflare-docs

dotam99 · 2024-05-13T20:40:54Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- developers.cloudflare.com/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	661/1000 Why? Recently disclosed, Has a fix available, CVSS 7.5	Uncontrolled resource consumption SNYK-JS-BRACES-6838727	Yes	No Known Exploit
	661/1000 Why? Recently disclosed, Has a fix available, CVSS 7.5	Inefficient Regular Expression Complexity SNYK-JS-MICROMATCH-6838728	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: gatsby

The new version differs by 250 commits.

78f8c7a chore(release): Publish
4dcdeb1 chore(gatsby): Add env log for build and remove incorrect log for functions (#36462) (#36466)
41de1f0 feat(gatsby): add partial hydration flag (#36436)
b8c2072 fix(gatsby-source-graphql): add dataLoaderOptions validation to gatsby-source-graphql (#36112)
b45debc chore(docs): fix incorrect closing tag in tutorial (#36459)
222793d chore(docs): Update plugin count in part 3 of the tutorial (#36455)
3222684 chore(docs): Fix page link to page 6 of remark tutorial (#36437)
0b458e6 chore(docs): Fix some typos (#36431)
1bf2358 fix(gatsby): remove resource query from warnings (#36439)
0d896ae chore(gatsby-plugin-sharp,gatsby-plugin-utils,gatsby-remark-images,gatsby-transformer-sharp): bump min potrace version (#36443)
a21510e docs: plugin image / image cdn (#36423)
8043d7e feat(docs): add webiny to headless cms list (#36388)
240dfac chore: update using-image-processing example (#36421)
b361081 chore(gatsby): drop eslint-plugin-graphql (#36364)
2e67161 chore(docs): Update tutorial to Head API (#36378)
77190f4 fix(deps): update starters and examples - gatsby (#36416)
c92404b chore(changelogs): update changelogs (#36417)
b7b3577 fix(gatsby-plugin-react-helmet): Typo in `onPreInit` warning (#36419)
7b3286c chore(docs): Add note about query name to MDX
dc283d7 chore: Use GCS for pipeline tests (#36413)
3760a0e feat(gatsby): Add option to emit TS types during build (#36405)
c01806e chore(release): Publish next
a05201e fix(gatsby): Prevent errors if `Head` has root text node (#36402)
9d737b6 fix(gatsby): close parcel cache db before clearing cache and retrying (#36377)

See the full diff

Package name: gatsby-plugin-sharp

The new version differs by 250 commits.

0a455df chore(release): Publish
91dc167 fix(gatsby): don't log FAST_DEV message for each worker (#32961) (#32967)
f936c93 fix(gatsby): set staticQueryResultHash to new hash on data change (#32949) (#32966)
ea161ce feat(gatsby-graphiql-explorer): upgrade to webpack 5 ([Turnstile] Pre-clear API requests cloudflare/cloudflare-docs#30642)
944e381 chore(release): Publish next
d6326df fix(gatsby-core-utils): Switch `auth` option from got to username/password (#32665)
cf9c066 fix(gatsby): add this typings to actions (Cashapp cloudflare/cloudflare-docs#32210)
53aa88e chore: enable test parallelism (#32766)
b7deabc fix(deps): update starters and examples - gatsby (#32843)
6025c84 chore(deps): update dependency katex to ^0.13.13 for gatsby-remark-katex (#32567)
d87c5cb chore: enable lmdb by default and update node for next major (#32695)
818d6c1 feat(gatsby-plugin-gatsby-cloud): Add `disablePreviewUI` option (#32907)
f556a00 chore: update changelogs (#32924)
aba5eba feat(gatsby): enable webpack caching in development for everyone (#32922)
ac7bd4e feat(gatsby-source-wordpress): allow path to js file for beforeChangeNode option (#32901)
1a87a8a docs(gatsby-source-wordpress): document content sync (#32768)
417df15 chore: re-generate changelogs (#32886)
1810874 fix(gatsby-source-wordpress): draft previews (#32915)
7c72ab8 chore(gatsby): remove unused packages (#32903)
afb06d7 chore(docs): Add hint for MDX plugin in remark-plugin-tutorial (#32876)
1303ecb chore(docs): Update wording for "using-web-fonts" (#32902)
9589911 chore(docs): Fix code highlighting in part 6 (#32900)
568d4ce feat(gatsby-source-drupal): Use the collection count from JSON:API extras to enable parallel API requests for cold builds (#32883)
41f5337 fix(deps): update typescript to ^4.29.3 (#32614)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncontrolled resource consumption

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-BRACES-6838727 - https://snyk.io/vuln/SNYK-JS-MICROMATCH-6838728

guardrails · 2024-05-13T20:42:59Z

⚠️ We detected 99 security issues in this pull request:

Mode: paranoid | Total findings: 99 | Considered vulnerability: 99

Hard-Coded Secrets (99)

Severity

Details

Docs

Medium

Title: Hex High Entropy String

cloudflare-docs/products/access/wrangler.toml

Line 12 in 3708b58

{ binding = "REDIRECTS", id = "8f79dc3f8f5840e1bde3fce52a67d62e" }

📚

Medium

Title: Hex High Entropy String

cloudflare-docs/products/argo-tunnel/wrangler.toml

Line 12 in 3708b58

{ binding = "REDIRECTS", id = "65462db7fc30456593591d0ee0384869" }

📚

Medium

Title: Hex High Entropy String

cloudflare-docs/products/bots/wrangler.toml

Line 12 in 3708b58

{ binding = "REDIRECTS", id = "8851304780a744369049e4612d5b7132" }

📚

Medium

Title: Hex High Entropy String

cloudflare-docs/products/cloudflare-one/wrangler.toml

Line 12 in 3708b58

{ binding = "REDIRECTS", id = "d67abaab47504270a65afcf3f6460f5d" }

📚

Medium

Title: Hex High Entropy String

cloudflare-docs/products/firewall/wrangler.toml

Line 12 in 3708b58

{ binding = "REDIRECTS", id = "6405ea2c8e794feca7b5dfcc5e53875a" }

📚

Medium

Title: Hex High Entropy String

cloudflare-docs/products/gateway/wrangler.toml

Line 12 in 3708b58

{ binding = "REDIRECTS", id = "8a91001065b6459483db0b898a58cd2e" }

📚

Medium

Title: Hex High Entropy String

cloudflare-docs/products/warp-client/wrangler.toml

Line 12 in 3708b58

{ binding = "REDIRECTS", id = "f28bd6bb32a84aa0b4827c5dc2466bc1" }

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/developers.cloudflare.com/src/components/mdx/directory-listing.js

Line 1 in 3708b58

    
           // Keep in sync with https://github.com/cloudflare/cloudflare-docs-engine/blob/ea2031c9575f7785ec9356963fd9cf6e00d2c379/src/components/mdx/directory-listing.js

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/contributing/development-setup.md

Line 9 in 3708b58

    
           1. Ensure you’re running node version `>=12.0.0`, as [specified by Docs Engine](https://github.com/cloudflare/cloudflare-docs-engine/blob/765bc30127b0e80b570aade7044036925928c3ea/package.json#L50).

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/contributing/development-setup.md

Line 36 in 3708b58

    
           4. Run the engine’s [`bootstrap` command](https://github.com/cloudflare/cloudflare-docs-engine/blob/765bc30127b0e80b570aade7044036925928c3ea/bin/commands.sh#L19-L39):

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/contributing/to-cloudflare-docs.md

Line 8 in 3708b58

    
           This guide is for contributors to [@cloudflare/cloudflare-docs](https://github.com/cloudflare/cloudflare-docs). To review the full contribution guidelines, see [Contributing to Cloudflare's Documentation](https://github.com/cloudflare/cloudflare-docs/blob/186d17204a509d4c8514b4c4dafd00974b4713b8/CONTRIBUTING.md).

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/faq.md

Line 41 in 3708b58

    
           Search is powered by Algolia DocSearch and [must be configured](/reference/configuration) in `docs-config.js`. Make a PR on [@algolia/docsearch-configs](https://github.com/algolia/docsearch-configs/pull/2300) to obtain an `indexName` and `apiKey` (e.g. see the [Workers PR](https://github.com/algolia/docsearch-configs/pull/2300)). Then simply set those values as `search.indexName` and `search.apiKey` (e.g. see the [Workers config](https://github.com/cloudflare/cloudflare-docs/blob/e72247549d20f649786251d0368de19560d1bbb2/products/workers/docs-config.js#L21-L24)). To disable search, set those values to the empty string (e.g. [Docs Engine example site](https://github.com/adamschwartz/docs-engine-example/blob/6d725ffa554454e1daa4c0d2a8a7e44408056e6b/docs-config.js#L21-L24)).

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/how-it-works.md

Line 29 in 3708b58

    
           However, these files can also be placed inside any sub-folder of your project. When doing this, you’ll need to then customize the `contentRepoFolder` property in `docs-config.js`, which is how the [products inside @cloudflare/cloudflare-docs](https://github.com/cloudflare/cloudflare-docs/tree/production/products) are all set up, e.g. the [Workers product](https://github.com/cloudflare/cloudflare-docs/blob/1efd366c25bc1bdd1a40f7bc4737310c6b00d15e/products/workers/docs-config.js#L6).

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/how-it-works.md

Line 92 in 3708b58

    
           The `search` field is used to add a search to the site, powered by Algolia DocSearch. To hide search, set `search.indexName` and `search.apiKey` to the empty string, as in the example above. For an example of a project using search, see the [Workers config](https://github.com/cloudflare/cloudflare-docs/blob/e72247549d20f649786251d0368de19560d1bbb2/products/workers/docs-config.js#L21-L24).

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/reference/configuration.md

Line 33 in 3708b58

    
           - By default the engine assumes that a docs site’s structure is placed in the root of a project repo. However, this whole structure can also be placed inside any sub-folder by setting this property. For example, this site’s content is inside the [`products/docs-engine` folder](https://github.com/cloudflare/cloudflare-docs/tree/4fd3a4af9507b20bb23fea4d7c4f4cd349c0f463/products/docs-engine) of [@cloudflare/cloudflare-docs](https://github.com/cloudflare/cloudflare-docs) so its `"products/docs-engine"`.

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/reference/configuration.md

Line 48 in 3708b58

    
           For an example of a project using search, see the [Workers config](https://github.com/cloudflare/cloudflare-docs/blob/e72247549d20f649786251d0368de19560d1bbb2/products/workers/docs-config.js#L21-L24).

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/reference/pages.md

Line 59 in 3708b58

    
           In the [Workers docs](https://developers.cloudflare.com/workers), there’s a partial used in the intro of all of the [Tutorials](https://developers.cloudflare.com/workers/tutorials), called “Before you start” which makes sure folks have the appropriate pre-requisites before starting a Workers tutorial ([source](https://github.com/cloudflare/cloudflare-docs/blob/4ba1e70d2a535c93ef6de42b0fc5178dabdb942b/products/workers/src/content/_partials/_tutorials-before-you-start.md)):

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/reference/pages.md

Line 71 in 3708b58

    
           Inside the tutorial it’s imported as you would any other MDX component ([source](https://github.com/cloudflare/cloudflare-docs/blob/4ba1e70d2a535c93ef6de42b0fc5178dabdb942b/products/workers/src/content/tutorials/build-a-qr-code-generator/index.md)):

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/reference/pages.md

Line 109 in 3708b58

    
           You can additional set your own frontmatter props in order to use them as variables inside of your pages. This is how the [Workers “Example” pages](https://github.com/cloudflare/cloudflare-docs/blob/4ba1e70d2a535c93ef6de42b0fc5178dabdb942b/products/workers/src/content/examples/alter-headers.md#L12) are constructed.

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/reference/pages.md

Line 123 in 3708b58

    
           If within a non-document-type page you’d like to have some content constrained by the normal content column, use the [`<ContentColumn/>` component](/reference/markdown#contentcolumn). The Workers Example pages use this component to [constrain the width](https://github.com/cloudflare/cloudflare-docs/blob/4ba1e70d2a535c93ef6de42b0fc5178dabdb942b/products/workers/src/content/examples/respond-with-another-site.md#L10-L22) of descriptive text while allowing the code example to be showcased.

📚

Medium

Title: Cloudflare Email

cloudflare-docs/.github/workflows/deploy.yml

Line 150 in 3708b58