open-duelyst/duelyst

[P1] Upgrade knex to 0.95.0+

Open

#54 aperta il 25 set 2022

Vedi su GitHub
 (3 commenti) (0 reazioni) (0 assegnatari)JavaScript (526 fork)batch import
backendhelp wantedsecurity

Metriche repository

Star
 (3443 star)
Metriche merge PR
 (Nessuna PR mergiata in 30 g)

Descrizione

Knex.js, our SQL query builder, has a few minor vulnerabilities in the current 0.19.5 version:

  ✗ Prototype Pollution [High Severity][https://security.snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660] in unset-value@1.0.0
    introduced by:
    knex@0.19.5 > liftoff@3.1.0 > findup-sync@3.0.0 > micromatch@3.1.10 > snapdragon@0.8.2 > base@0.11.2 > cache-base@1.0.1 > unset-value@1.0.0
    knex@0.19.5 > liftoff@3.1.0 > findup-sync@3.0.0 > micromatch@3.1.10 > braces@2.3.2 > snapdragon@0.8.2 > base@0.11.2 > cache-base@1.0.1 > unset-value@1.0.0
    knex@0.19.5 > liftoff@3.1.0 > findup-sync@3.0.0 > micromatch@3.1.10 > extglob@2.0.4 > snapdragon@0.8.2 > base@0.11.2 > cache-base@1.0.1 > unset-value@1.0.0
    knex@0.19.5 > liftoff@3.1.0 > findup-sync@3.0.0 > micromatch@3.1.10 > nanomatch@1.2.13 > snapdragon@0.8.2 > base@0.11.2 > cache-base@1.0.1 > unset-value@1.0.0
    knex@0.19.5 > liftoff@3.1.0 > findup-sync@3.0.0 > micromatch@3.1.10 > extglob@2.0.4 > expand-brackets@2.1.4 > snapdragon@0.8.2 > base@0.11.2 > cache-base@1.0.1 > unset-value@1.0.0

We should upgrade to 0.95.0 by following this guide: https://github.com/knex/knex/blob/master/UPGRADING.md#upgrading-to-version-0950

This may require changes to code in the cli, scripts, server, test, and worker directories.

Guida contributor