mern-authentication icon indicating copy to clipboard operation
mern-authentication copied to clipboard
verified publisher icon flaviuse

[Snyk] Upgrade winston from 3.3.3 to 3.7.2

Open flaviuse opened this issue 4 years ago • 0 comments

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to upgrade winston from 3.3.3 to 3.7.2.

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 7 versions ahead of your current version.
  • The recommended version was released 22 days ago, on 2022-04-04.

The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Directory Traversal
SNYK-JS-MOMENT-2440688		 661/1000
Why? Recently disclosed, Has a fix available, CVSS 7.5		 No Known Exploit
Prototype Pollution
SNYK-JS-ASYNC-2441827		 661/1000
Why? Recently disclosed, Has a fix available, CVSS 7.5		 Proof of Concept
Regular Expression Denial of Service (ReDoS)
SNYK-JS-RAMDA-1582370		 661/1000
Why? Recently disclosed, Has a fix available, CVSS 7.5		 No Known Exploit
Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2332181		 661/1000
Why? Recently disclosed, Has a fix available, CVSS 7.5		 Proof of Concept
Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2396346		 661/1000
Why? Recently disclosed, Has a fix available, CVSS 7.5		 No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: winston
  • 3.7.2 - 2022-04-04
  • 3.7.1 - 2022-04-04

    This change includes some minor updates to package-lock.json resolving npm audit failures: one in ansi-regex and another in minimist.

    Full Changelog: v3.7.0...v3.7.1

  • 3.6.0 - 2022-02-12

    v3.5.1...v3.6.0

  • 3.5.1 - 2022-01-31

    This release reverts the changes made in PR #1896 which added stricter typing to the available log levels,
    and inadvertently broke use of custom levels with TypeScript (Issue #2047). Apologies for that!

  • 3.5.0 - 2022-01-27

    This release includes the following, in sequence by first merge in group:

    Feature updates:

    Patch-level updates:

    • Bump dependency versions (thanks @ dependabot & @ DABH!)
      • Bump @ types/node from 16.11.12 to 17.0.8 (PR #2009)
      • Bump @ babel/preset-env from 7.16.7 to 7.16.8 (#2036)
      • Bump @ types/node from 17.0.8 to 17.0.9 (#2035)
      • Bump @ babel/cli from 7.16.7 to 7.16.8 (#2034)
      • Bump @ types/node from 17.0.9 to 17.0.10 (#2042)
      • Bump @ babel/core from 7.16.7 to 7.16.12 (#2041)
      • Bump @ babel/preset-env from 7.16.8 to 7.16.11 (#2040)
    • Fixing documentation syntax errors in transports code examples (#1916; thanks @ romanzaycev!)
    • Fix missing type declarations, especially for .rejections (#1842, #1929, #2021; thanks @ vanflux, @ svaj, @ glensc, & others!)
    • More narrowly typing the “level” string (#1896, thanks @ yonas-g!)
    • Using a safer stringify, e.g. to avoid issues from circular structures, in the http transport (#2043, thanks @ karlwir!)

    Updates to the repo & project which don’t actually affect the running code:

    Thanks also to maintainers @ DABH, @ fearphage, @ maverick1872, and @ wbt for issue/PR shepherding and help across multiple parts of the release!

    If somebody got missed in the list of thanks, please forgive the accidental oversight and/or feel free to open a PR on the changelog.

  • 3.4.0 - 2022-01-10 Read more
  • 3.3.4 - 2022-01-10

    Version 3.3.4

  • 3.3.3 - 2020-06-23 Read more
from winston GitHub release notes
Commit messages
Package name: winston
  • 7937f33 Revert for 2103 (#2104)
  • 68f595b Update changelog
  • 2aa2d4f Bump to 3.7.1
  • ce6fbc9 Bump ansi-regex in package-lock due to
  • cdf1da5 Bump minimist in package-lock due to
  • 23f29b1 Bump version number in package-lock
  • 3c79a63 Release - v3.7.0 (#2101)
  • 32bfa76 Bump @ babel/core from 7.17.5 to 7.17.8 (#2093)
  • efa495d Bump eslint from 8.10.0 to 8.12.0 (#2098)
  • 6fad825 Bump @ types/node from 17.0.21 to 17.0.23 (#2099)
  • ba93eae fix(metadata precedence) - fix metadata override issues (#1989)
  • e4acc5a Bump actions/setup-node from 2 to 3 (#2081)
  • 70fc03d Bump @ types/node from 17.0.17 to 17.0.21 (#2084)
  • 64351af Bump eslint from 8.9.0 to 8.10.0 (#2083)
  • b068f14 Bump @ babel/cli from 7.17.0 to 7.17.6 (#2082)
  • d9bba28 Bump @ babel/core from 7.17.2 to 7.17.5 (#2079)
  • 0dae690 Bump actions/checkout from 2 to 3 (#2086)
  • c9e5f17 Bump @ dabh/diagnostics from 2.0.2 to 2.0.3 (#2074)
  • b09fa5d Feature: Further improve issue templates (#2073)
  • d1d9358 Fix: add missing type of batch http option (#2075)
  • b2fde9d 3.6.0
  • 5e72485 Changelog updates for v3.6.0
  • 93077ef Update dependencies, including latest logform (#2071)
  • 035f94a Update to @ colors/colors (#2069)

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

flaviuse avatar Apr 26 '22 17:04 flaviuse