From fe76ab4ea5c91ad7785478d6ef2fba8335d4de25 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Thu, 30 Apr 2020 15:48:48 -0700 Subject: [PATCH 1/2] fix: .snyk & package.json to reduce vulnerabilities The following vulnerabilities are fixed with a Snyk patch: - https://snyk.io/vuln/SNYK-JS-LODASH-567746 --- .snyk | 70 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 .snyk diff --git a/.snyk b/.snyk new file mode 100644 index 0000000..d1c064a --- /dev/null +++ b/.snyk @@ -0,0 +1,70 @@ +# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. +version: v1.14.1 +ignore: {} +# patches apply the minimum changes required to fix a vulnerability +patch: + SNYK-JS-LODASH-567746: + - babel-core > lodash: + patched: '2020-04-30T22:48:46.341Z' + - graphql-apollo-errors > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-types > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-generator > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-traverse > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-template > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-register > lodash: + patched: '2020-04-30T22:48:46.341Z' + - graphql-apollo-errors > seven-boom > lodash: + patched: '2020-04-30T22:48:46.341Z' + - request-promise > request-promise-core > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-generator > babel-types > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-traverse > babel-types > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-template > babel-types > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-template > babel-traverse > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-helpers > babel-template > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-register > babel-core > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-template > babel-traverse > babel-types > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-helpers > babel-template > babel-types > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-register > babel-core > babel-types > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-register > babel-core > babel-generator > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-helpers > babel-template > babel-traverse > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-register > babel-core > babel-traverse > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-register > babel-core > babel-template > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-register > babel-core > babel-generator > babel-types > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-helpers > babel-template > babel-traverse > babel-types > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-register > babel-core > babel-traverse > babel-types > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-register > babel-core > babel-template > babel-types > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-register > babel-core > babel-template > babel-traverse > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-register > babel-core > babel-helpers > babel-template > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-register > babel-core > babel-template > babel-traverse > babel-types > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-register > babel-core > babel-helpers > babel-template > babel-types > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-register > babel-core > babel-helpers > babel-template > babel-traverse > lodash: + patched: '2020-04-30T22:48:46.341Z' + - babel-core > babel-register > babel-core > babel-helpers > babel-template > babel-traverse > babel-types > lodash: + patched: '2020-04-30T22:48:46.341Z' From 32e3b0fd55384edf41a4438de5dd82e9f6bc7dca Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Thu, 30 Apr 2020 15:48:49 -0700 Subject: [PATCH 2/2] fix: .snyk & package.json to reduce vulnerabilities The following vulnerabilities are fixed with a Snyk patch: - https://snyk.io/vuln/SNYK-JS-LODASH-567746 --- package.json | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/package.json b/package.json index 112f06e..a75ad1c 100644 --- a/package.json +++ b/package.json @@ -28,7 +28,9 @@ "lint": "eslint src/**/*.js", "test": "npm run lint --silent && npm run test:unit --silent", "test:unit": "cross-env NODE_ENV=test LOG4JS_LEVEL='OFF' jest --coverage", - "semantic-release": "semantic-release pre && npm publish --access public && semantic-release post" + "semantic-release": "semantic-release pre && npm publish --access public && semantic-release post", + "snyk-protect": "snyk protect", + "prepare": "yarn run snyk-protect" }, "dependencies": { "babel-core": "^6.24.1", @@ -42,7 +44,8 @@ "request-promise": "^4.2.1", "shelljs": "^0.7.8", "uuid": "^3.1.0", - "yargs": "^9.0.1" + "yargs": "^9.0.1", + "snyk": "^1.316.1" }, "peerDependencies": { "apollo-server-express": "^1.1.2", @@ -102,5 +105,6 @@ "keywords": [ "graphql", "apollo" - ] + ], + "snyk": true }