Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Upgrade @lhci/cli from 0.7.2 to 0.13.0 #250

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Upgrade @lhci/cli from 0.7.2 to 0.13.0 #250

wants to merge 1 commit into from

Conversation

NOUIY
Copy link
Owner

@NOUIY NOUIY commented May 26, 2024

This PR was automatically created by Snyk using the credentials of a real user.


![snyk-top-banner](https://github.com/andygongea/OWASP-Benchmark/assets/818805/c518c423-16fe-447e-b67f-ad5a49b5d123)

Snyk has created this PR to upgrade @lhci/cli from 0.7.2 to 0.13.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 9 versions ahead of your current version.

  • The recommended version was released on 5 months ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
medium severity Open Redirect
SNYK-JS-GOT-2932019		 484 No Known Exploit
medium severity Server-side Request Forgery (SSRF)
SNYK-JS-REQUEST-3361831		 484 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-TOUGHCOOKIE-5672873		 484 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-WS-1296835		 484 Proof of Concept
Release notes
Package name: @lhci/cli
  • 0.13.0 - 2023-12-15

    v0.13.0 (2023-12-15)

    • feat: sort projects by name (#976) (2bf36f4), closes #976
    • feat: upgrade to lighthouse 11.4.0 (#991) (7cc4ba8), closes #991
    • feat(cli): add static dir file discovery depth flag (#940) (de1614e), closes #940
    • fix(docker): added extra environment variable to lhci-client Dockerfile for puppeteer executable (#9 (f28992b), closes #916
    • docs: add *.cjs to supported config extensions (#975) (a706c54), closes #975
    • docs: fix typo of puppeterScript to puppeteerScript (#979) (b16e48d), closes #979
    • tests: use more random name for sql test file (#986) (72b79d8), closes #986
    • chore: update docker images with latest version (9d710c1)
    • chore: rebaseline snapshot images (#980) (7e75eed), closes #980
    • chore: remove jest worker limit (#981) (91bfbf9), closes #981
    • chore: set jest max workers to 1 (#985) (200b915), closes #985
    • chore: bump to node 18 (#989) (c5bde95), closes #989
    • chore(deps): run yarn audit fix to upgrade many deps (#992) (3ea9955), closes #992
    • chore(deps): upgrade to storybook 7.6.4, preact 10.19.3, esbuild 0.19.9 (#990) (5d30e52), closes #990
    • chore(deps): bump lodash from 4.17.11 to 4.17.21 (#956) (00b2c91), closes #956
    • chore(deps): bump handlebars from 4.1.2 to 4.7.8 (#978) (c183f9f), closes #978
    • chore(deps): bump @ babel/traverse from 7.4.3 to 7.23.6 (#987) (60693f0), closes #987
    • chore(deps): bump browserify-sign from 4.0.4 to 4.2.2 (#957) (e40dec0), closes #957
    • chore(deps): bump tree-kill from 1.2.1 to 1.2.2 (#952) (2bd2e9c), closes #952
    • chores(deps): upgrade puppeteer to 21.6.1 (#988) (939ef03), closes #988
    • chores(deps): upgrade umzug to 3.4.0 (#984) (a3ee284), closes #984
    • chores(deps): upgrade typescript to 5.3.3 (#983) (29a67d9), closes #983
    • chores(deps): upgrade sequelize to 6.35.2 (#982) (5b94d30), closes #982
    • collect: use new headless mode (#907) (2cf4dc0), closes #907
    • Readme: Update Heroku mentions (#931) (b124841), closes #931
    • Instruct users to install Lighthouse CI 0.12 (#927) (72db595), closes #927
    • catch localStorage exceptions in difftool (#938) (332888a), closes #938

    BREAKING CHANGE

    • minimum supported node is now 18
    • upgrade to lighthouse 11.4.0
  • 0.12.0 - 2023-04-14

    v0.12.0 (2023-04-14)

    • feat: upgrade to Lighthouse 10.1.0 (#899) (7c8d0a9), closes #899
    • chore: update docker images with latest version (fd649a1)
    • detect 11ty's output dir as staticDistDir (#895) (ebff823), closes #895
    • audit diff: use good keys for nodes and taptargets (#883) (badea06), closes #883
  • 0.11.1 - 2023-04-12

    v0.11.1 (2023-04-12)

    • feat(server): allow suppressing bodyParser to use own middleware (#877) (20d08c0), closes #877
    • fix: update render snapshots (#898) (0dc0c1e), closes #898
    • fix(server): skip needless/verbose audit diffs (#881) (b484e69), closes #881
    • chore: update docker images with latest version (d7240dc)
    • misc: use cache in ci.yml (#854) (617a436), closes #854
    • Fix static subresource paths for server/viewer (#879) (584d306), closes #879
    • diff tool - friendlier landing page (#880) (c450e8c), closes #880
    • diff tool. tweak hover logo (5ae6a66)
    • use current versions on GitHub Actions, LHCI and Node (#817) (43e23dc), closes #817
    • fix viewer demo link (14df185)
  • 0.11.0 - 2023-02-21

    v0.11.0 (2023-02-21)

    • feat: upgrade to lighthouse 9.6.8 (#840) (3bf80bf), closes #840
    • feat(cli): use requestedUrl instead of finalUrl for upload context naming (#849) (2618b5f), closes #849
    • tests: fix windows unit tests (#872) (1a797a3), closes #872
    • chore: update docker images with latest version (3560e81)
    • chore(dep): upgrade to puppeteer 19.7.1 (#871) (60aa39c), closes #871

    BREAKING CHANGE

    • reports uploaded to slightly different location, now based on requestedUrl instead of finalUrl
  • 0.10.0 - 2022-11-15

    v0.10.0 (2022-11-15)

    • feat: extract type defs to assert.d.ts (#785) (d218192), closes #785
    • feat(cli): API requests will respect HTTP_PROXY env variable (#727) (55fd467), closes #727
    • feat(cli): added url hash to differentiate between urls (#835) (ada2782), closes #835
    • fix(docker): include globally installed puppeteer (#736) (43afef4), closes #736
    • fix(docker): update deps in docker-server to match global deps (#779) (aa10d00), closes #779
    • fix(server): CLS diff not showing on compare screen (#784) (0fe44dd), closes #784
    • docs: update CircleCI config example (#721) (d41928d), closes #721
    • docs: clarify when Github status checks apply (#822) (75f4bb8), closes #822
    • docs(heroku): fix recipe for Heroku to support LHCI 0.9.0 (#782) (0da6496), closes #782
    • tests: use relative path in utils test files (#737) (908b075), closes #737
    • chore: update docker images with latest version (#754) (fe181b6), closes #754
    • chore: add commitMessage to storybook tests (#744) (c9a3684), closes #744
    • chore: bump to node 16 in dockerfiles (#841) (71d3af2), closes #841
    • chore(deps): node 16, storybook, esbuild (#839) (e4c2b2c), closes #839
    • chore(deps): remove update-notifier (#756) (fea2fd4), closes #756
    • chore(docs): update security tradeoff link (#815) (b7f59c6), closes #815
    • chore(docs): s/enviroment/environment (#720) (ff1f14d), closes #720
    • update dockerfiles to use node 14 (#772) (9deb96d), closes #772
    • fix standalone viewer build via build-app adjustments (#786) (72270e7), closes #786
    • Update minimum node version requirement (#803) (c8957a8), closes #803
    • fix typecheck (fbd4465)

    BREAKING CHANGE

    • minimum node version is now 16
  • 0.9.0 - 2022-02-01

    v0.9.0 (2022-02-01)

    • feat: upgrade to lighthouse 9.3.0 (#726) (6e4585d), closes #726
    • fix(viewer): use correct publicPath, replace process.env (#753) (5963dcc), closes #753
    • refactor: use esbuild instead of parcel, upgrade to node 14 (#738) (25da3dc), closes #738
    • chore: update docker images with latest version (b88cfec)
    • chore(dep): upgrade to puppeteer 13.1.2 (#740) (2ca0b86), closes #740
    • chore(deps): update lint deps and use implicit configuration (#751) (0fe68af), closes #751
    • chore(deps): upgrade to prettier 2.5.1 (#750) (d6a62b9), closes #750
    • chore(deps): upgrade to storybook 6.4.13 (#745) (ed1b3cb), closes #745
    • chore(deps): upgrade to typescript 4 (#739) (b049ed7), closes #739
    • Use proper capitalization for Cloud Build (#741) (eb44b57), closes #741

    BREAKING CHANGE

    • upgrade to lighthouse v9.3.0
    • minimum node version is now 14
  • 0.8.2 - 2021-09-28

    v0.8.2 (2021-09-28)

    • feat(server): more configuration of psiCollectCron (#696) (0427e08), closes #696
    • feat(server): add LCP, TBT and MPFID to distribution graphs (#694) (f5c5ba5), closes #694
    • fix(server): decode URLs for display (#678) (f6d1015), closes #678
    • fix(server): ensure history commit message easy to read (#688) (3c1c4bf), closes #688
    • fix(utils): throw on non-200 version response (#677) (ddfac21), closes #677
    • docs: add community guide for LHCI server in Azure (#682) (372a47b), closes #682
    • docs(heroku): fix recipe for heroku SSL (4c03466)
    • chore: update docker images with latest version (69c927d)
    • chore: use disable dev shm in docker tests (4930567)
  • 0.8.1 - 2021-09-01

    v0.8.1 (2021-09-01)

    • feat(cli): support cjs config file extension (#650) (31e731a), closes #650
    • feat(cli): add psiStrategy option for PSI runner (#631) (e840cb0), closes #631
    • feat(server): add support for sequlize migration options (#653) (3f1a636), closes #653
    • fix(server): proper CLS detail rendering (67f4a95)
    • fix(server): do not display diffs of debugdata (0c26855)
    • fix(server): support closed network operation (#637) (543b142), closes #637
    • fix(utils): handle preact state circular annotations (070f825)
    • docs: add more custom server and LH config examples (ecbde70), closes #625
    • docs: update examples to use 0.8.x (#633) (ef8b8c7), closes #633
    • docs: fix readability of CLI arg on configuration (#634) (438f3e1), closes #634
    • docs: add FAQ for GitHub Actions checkout v2 fetch-depth (#642) (950669e), closes #642
    • docs: update readme to use 0.8.x (#654) (844ff1c), closes

@snyk-bot
fix: upgrade @lhci/cli from 0.7.2 to 0.13.0
2bf4dda 
Snyk has created this PR to upgrade @lhci/cli from 0.7.2 to 0.13.0.

See this package in npm:
@lhci/cli

See this project in Snyk:
https://app.snyk.io/org/nexuscompute/project/b621f8be-de26-4791-bbe0-28c6fc5bd7f5?utm_source=github&utm_medium=referral&page=upgrade-pr
@guardrails GuardRails
Copy link

guardrails bot commented May 26, 2024

⚠️ We detected 8 security issues in this pull request:

Vulnerable Libraries (8)
Severity Details
High pkg:npm/[email protected] (t) upgrade to: > 4.3.8
High pkg:npm/@lhci/[email protected] upgrade to: > 0.13.0
Critical pkg:npm/@google-cloud/[email protected] (t) upgrade to: > 3.12.0
Medium pkg:npm/[email protected] (t) upgrade to: 4.19.2,5.0.0-beta.3
High pkg:npm/[email protected] (t) upgrade to: > 3.15.0
N/A pkg:npm/[email protected] (t) upgrade to: 15.10.1
Medium pkg:npm/[email protected] (t) upgrade to: > 3.1.1
High pkg:npm/@11ty/[email protected] (t) upgrade to: > 1.0.2

More info on how to fix Vulnerable Libraries in JavaScript.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Better documentation for extensions
2 participants
@NOUIY @snyk-bot