mause / proxy-up Goto Github PK
View Code? Open in Web Editor NEWHome Page: https://up.vc.mause.me/openapi.yaml
License: MIT License
Home Page: https://up.vc.mause.me/openapi.yaml
License: MIT License
This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
These updates are currently rate-limited. Click on a checkbox below to force their creation now.
These updates have all been created already. Click a checkbox below to force a retry/rebase of any.
@types/jest
, jest
, ts-jest
).github/workflows/build.yaml
actions/checkout v3
actions/setup-node v3.3.0
actions/upload-artifact v3
.github/workflows/generate-client.yaml
actions/setup-node v3.3.0
technote-space/create-pr-action v2
package.json
@logtail/bunyan ^0.1.10
@logtail/node ^0.1.10
@types/bunyan ^1.8.8
@types/lodash ^4.14.178
@types/node ^16.11.41
@vercel/node ^2.0.0
axios ^0.27.2
bunyan >=2.0.0
class-transformer ^0.5.1
class-validator ^0.13.2
reflect-metadata ^0.1.13
typescript ^4.5.4
vercel-jwt-auth ^1.1.9
@types/jest ^28.0.0
@types/jsonwebtoken ^8.5.8
@types/moxios ^0.4.14
@types/test-listen ^1.1.0
jest ^28.0.0
jsonwebtoken ^8.5.1
moxios ^0.4.0
test-listen ^1.1.0
ts-jest ^28.0.0
vercel-node-server ^2.2.1
vercel-openapi ^0.1.13
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/moment/package.json
Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc
CVE | Severity | CVSS | Dependency | Type | Fixed in | Remediation Available |
---|---|---|---|---|---|---|
CVE-2022-31129 | High | 7.5 | moment-2.29.1.tgz | Transitive | N/A | โ |
CVE-2022-24785 | High | 7.5 | moment-2.29.1.tgz | Transitive | N/A | โ |
CVE-2021-44906 | Medium | 5.0 | minimist-1.2.5.tgz | Transitive | N/A | โ |
Parse, validate, manipulate, and display dates
Library home page: https://registry.npmjs.org/moment/-/moment-2.29.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/moment/package.json
Dependency Hierarchy:
Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc
Found in base branch: main
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.
Publish Date: 2022-07-06
URL: CVE-2022-31129
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-wc69-rhjr-hc9g
Release Date: 2022-07-06
Fix Resolution: moment - 2.29.4
Step up your Open Source Security Game with Mend here
Parse, validate, manipulate, and display dates
Library home page: https://registry.npmjs.org/moment/-/moment-2.29.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/moment/package.json
Dependency Hierarchy:
Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc
Found in base branch: main
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
Publish Date: 2022-04-04
URL: CVE-2022-24785
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-8hfj-j24r-96c4
Release Date: 2022-04-04
Fix Resolution: moment - 2.29.2,Moment.js - 2.29.2
Step up your Open Source Security Game with Mend here
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/minimist/package.json
Dependency Hierarchy:
Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc
Found in base branch: main
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Publish Date: 2022-03-17
URL: CVE-2021-44906
Base Score Metrics:
Type: Upgrade version
Release Date: 2022-03-17
Fix Resolution: minimist - 1.2.6
Step up your Open Source Security Game with Mend here
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/async/package.json
Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc
CVE | Severity | CVSS | Dependency | Type | Fixed in | Remediation Available |
---|---|---|---|---|---|---|
CVE-2021-43138 | High | 7.8 | async-1.5.2.tgz | Transitive | 1.1.10 | โ |
Higher-order functions and common patterns for asynchronous code
Library home page: https://registry.npmjs.org/async/-/async-1.5.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/async/package.json
Dependency Hierarchy:
Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc
Found in base branch: main
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
Publish Date: 2022-04-06
URL: CVE-2021-43138
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138
Release Date: 2022-04-06
Fix Resolution (async): 2.6.4
Direct dependency fix Resolution (vercel-jwt-auth): 1.1.10
Step up your Open Source Security Game with Mend here
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/follow-redirects/package.json
Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc
CVE | Severity | CVSS | Dependency | Type | Fixed in | Remediation Available |
---|---|---|---|---|---|---|
CVE-2022-0536 | Medium | 5.9 | follow-redirects-1.14.7.tgz | Transitive | 0.25.0 | โ |
HTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.7.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/follow-redirects/package.json
Dependency Hierarchy:
Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc
Found in base branch: main
Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.
Publish Date: 2022-02-09
URL: CVE-2022-0536
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536
Release Date: 2022-02-09
Fix Resolution (follow-redirects): 1.14.8
Direct dependency fix Resolution (axios): 0.25.0
Step up your Open Source Security Game with Mend here
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-fetch/package.json
Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc
CVE | Severity | CVSS | Dependency | Type | Fixed in | Remediation Available |
---|---|---|---|---|---|---|
CVE-2022-0235 | Medium | 6.1 | node-fetch-2.6.1.tgz | Transitive | 0.1.12 | โ |
A light-weight module that brings window.fetch to node.js
Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-fetch/package.json
Dependency Hierarchy:
Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc
Found in base branch: main
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Publish Date: 2022-01-16
URL: CVE-2022-0235
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-r683-j2x4-v87g
Release Date: 2022-01-16
Fix Resolution (node-fetch): 2.6.7
Direct dependency fix Resolution (@logtail/node): 0.1.12
Step up your Open Source Security Game with Mend here
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.