From 3ec1ec3456c6558a2656722191f6b42336a58586 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Thu, 30 Apr 2020 23:15:27 +0200 Subject: [PATCH 1/2] fix: package.json & .snyk to reduce vulnerabilities The following vulnerabilities are fixed with a Snyk patch: - https://snyk.io/vuln/SNYK-JS-LODASH-567746 --- package.json | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/package.json b/package.json index 8b93e04..cfff6c2 100644 --- a/package.json +++ b/package.json @@ -13,7 +13,9 @@ "release-minor": "aegir release --type minor", "release-major": "aegir release --type major", "coverage": "aegir coverage", - "coverage-publish": "aegir coverage -u" + "coverage-publish": "aegir coverage -u", + "snyk-protect": "snyk protect", + "prepublish": "npm run snyk-protect" }, "keywords": [ "zeronet", @@ -31,7 +33,8 @@ "homepage": "https://github.com/ZeroNetJS/zeronet-ipld#readme", "dependencies": { "ipld-resolver": "~0.14.1", - "multicodec": "github:mkg20001/js-multicodec#zeronet-ipld-test" + "multicodec": "github:mkg20001/js-multicodec#zeronet-ipld-test", + "snyk": "^1.316.1" }, "devDependencies": { "aegir": "^12.3.0" @@ -40,5 +43,6 @@ "test": "test", "src": "src", "lib": "src" - } + }, + "snyk": true } From 7cc95eff966200b7d3c7e47afd89a1bd25346714 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Thu, 30 Apr 2020 23:15:28 +0200 Subject: [PATCH 2/2] fix: package.json & .snyk to reduce vulnerabilities The following vulnerabilities are fixed with a Snyk patch: - https://snyk.io/vuln/SNYK-JS-LODASH-567746 --- .snyk | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 .snyk diff --git a/.snyk b/.snyk new file mode 100644 index 0000000..fb8b426 --- /dev/null +++ b/.snyk @@ -0,0 +1,52 @@ +# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. +version: v1.14.1 +ignore: {} +# patches apply the minimum changes required to fix a vulnerability +patch: + SNYK-JS-LODASH-567746: + - ipld-resolver > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > interface-datastore > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipfs-repo > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipld-dag-cbor > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipld-dag-pb > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipld-ethereum > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipld-git > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipfs-repo > interface-datastore > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipfs-repo > datastore-core > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipfs-repo > datastore-fs > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipfs-repo > lock-me > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipld-dag-cbor > multihashing-async > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipld-dag-pb > multihashing-async > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipld-ethereum > multihashing-async > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipld-git > multihashing-async > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipld-ethereum > ethereumjs-block > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipfs-repo > datastore-core > interface-datastore > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipfs-repo > datastore-fs > interface-datastore > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipfs-repo > datastore-level > interface-datastore > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipfs-repo > datastore-fs > datastore-core > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipfs-repo > datastore-level > datastore-core > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipfs-repo > datastore-fs > datastore-core > interface-datastore > async > lodash: + patched: '2020-04-30T21:15:25.607Z' + - ipld-resolver > ipfs-repo > datastore-level > datastore-core > interface-datastore > async > lodash: + patched: '2020-04-30T21:15:25.607Z'