From f585896b7ca325eab4510db17e5c1c1468c09d16 Mon Sep 17 00:00:00 2001 From: Dylan Leard Date: Fri, 17 Nov 2023 09:08:54 -0800 Subject: [PATCH] chore: fix CVEs CVE-2023-45857 + CVE-2023-46233 --- app/package.json | 6 ++-- app/yarn.lock | 75 ++++++++++++++++++++++++------------------------ 2 files changed, 41 insertions(+), 40 deletions(-) diff --git a/app/package.json b/app/package.json index 8072a3b9ce..958b57b487 100644 --- a/app/package.json +++ b/app/package.json @@ -56,8 +56,8 @@ "eslint-plugin-jest": "^25.2.1", "eslint-plugin-react": "^7.31.10", "eslint-plugin-relay": "^1.8.2", - "happo-cypress": "^4.0.0", - "happo-e2e": "^2.1.2", + "happo-cypress": "^4.1.1", + "happo-e2e": "^2.2.5", "happo.io": "^8.3.1", "improved-yarn-audit": "^3.0.0", "jest": "^27.5.1", @@ -71,7 +71,7 @@ "relay-test-utils": "13.2.0", "ts-node": "^10.3.0", "typescript": "^4.4.4", - "wait-on": "^7.0.1" + "wait-on": "^7.2.0" }, "dependencies": { "@bcgov-cas/sso-express": "^3.2.0", diff --git a/app/yarn.lock b/app/yarn.lock index 973a578f8c..421e9ce5d9 100644 --- a/app/yarn.lock +++ b/app/yarn.lock @@ -3365,13 +3365,14 @@ axe-core@^4.4.3: resolved "https://registry.yarnpkg.com/axe-core/-/axe-core-4.5.0.tgz#6efe2ecdba205fcc9d7ddb3d48c2cf630f70eb5e" integrity sha512-4+rr8eQ7+XXS5nZrKcMO/AikHL0hVqy+lHWAnE3xdHl+aguag8SOQ6eEqLexwLNWgXIMfunGuD3ON1/6Kyet0A== -axios@^0.27.2: - version "0.27.2" - resolved "https://registry.yarnpkg.com/axios/-/axios-0.27.2.tgz#207658cc8621606e586c85db4b41a750e756d972" - integrity sha512-t+yRIyySRTp/wua5xEr+z1q60QmLq8ABsS5O9Me1AsE5dfKqgnCFzwiCZZ/cGNd1lq4/7akDWMxdhVlucjmnOQ== +axios@^1.6.1: + version "1.6.2" + resolved "https://registry.yarnpkg.com/axios/-/axios-1.6.2.tgz#de67d42c755b571d3e698df1b6504cde9b0ee9f2" + integrity sha512-7i24Ri4pmDRfJTR7LDBhsOTtcm+9kjX5WiY1X3wIisx6G9So3pfMkEiU7emUBe46oceVImccTEM3k6C5dbVW8A== dependencies: - follow-redirects "^1.14.9" + follow-redirects "^1.15.0" form-data "^4.0.0" + proxy-from-env "^1.1.0" axobject-query@^2.2.0: version "2.2.0" @@ -4215,9 +4216,9 @@ cross-spawn@^7.0.0, cross-spawn@^7.0.2, cross-spawn@^7.0.3: which "^2.0.1" crypto-js@^4.1.1: - version "4.1.1" - resolved "https://registry.yarnpkg.com/crypto-js/-/crypto-js-4.1.1.tgz#9e485bcf03521041bd85844786b83fb7619736cf" - integrity sha512-o2JlM7ydqd3Qk9CA0L4NL6mTzU2sdx96a+oOfPu8Mkl/PK51vSyoi8/rQ8NknZtk44vq15lmhAj9CIAGwgeWKw== + version "4.2.0" + resolved "https://registry.yarnpkg.com/crypto-js/-/crypto-js-4.2.0.tgz#4d931639ecdfd12ff80e8186dba6af2c2e856631" + integrity sha512-KALDyEYgpY+Rlob/iriUtjV6d5Eq+Y191A5g4UqLAi8CyGP9N1+FdVbkc1SxKc2r4YAYqG8JzO2KGL+AizD70Q== crypto-random-string@^2.0.0: version "2.0.0" @@ -5625,10 +5626,10 @@ flatted@^3.1.0: resolved "https://registry.yarnpkg.com/flatted/-/flatted-3.2.4.tgz#28d9969ea90661b5134259f312ab6aa7929ac5e2" integrity sha512-8/sOawo8tJ4QOBX8YlQBMxL8+RLZfxMQOif9o0KUKTNTjMYElWPE0r/m5VNFxTRd0NSw8qSy8dajrwX4RYI1Hw== -follow-redirects@^1.14.9: - version "1.15.2" - resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.2.tgz#b460864144ba63f2681096f274c4e57026da2c13" - integrity sha512-VQLG33o04KaQ8uYi2tVNbdrWp1QWxNNea+nmIB4EVM28v0hmP17z7aG1+wAkNzVq4KeXTq3221ye5qTJP91JwA== +follow-redirects@^1.15.0: + version "1.15.3" + resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.3.tgz#fe2f3ef2690afce7e82ed0b44db08165b207123a" + integrity sha512-1VzOtuEM8pC9SFU1E+8KfTjZyMztRsgEfwQl44z8A25uy13jSzTj6dyK2Df52iV0vgHCfBwLhDWevLn95w5v6Q== forever-agent@~0.6.1: version "0.6.1" @@ -6096,15 +6097,15 @@ gtoken@^5.0.4: google-p12-pem "^3.1.3" jws "^4.0.0" -happo-cypress@^4.0.0: - version "4.0.1" - resolved "https://registry.yarnpkg.com/happo-cypress/-/happo-cypress-4.0.1.tgz#e02e3740461cf44450648ea6b0ebc296d164a354" - integrity sha512-4cXFwfaALDTTKH95FGbWN4V0zWnv30XTxxmBTJV/YkqXuozsWRBiZOR7eC0WT2wZ9hiaBhNiw5J/w00RZ0zbCw== +happo-cypress@^4.1.1: + version "4.1.1" + resolved "https://registry.yarnpkg.com/happo-cypress/-/happo-cypress-4.1.1.tgz#d10f064fad72a6a733a22f2baa234518e582b6bc" + integrity sha512-qMSjOOlCGjGis+i/VTzcL8/2te73I2jrNcQkx+rJgcbgYV7x13tiEVVo/MrR5lCg7kHtXiNNXAXgw7XUxNh3pQ== -happo-e2e@^2.1.2: - version "2.2.0" - resolved "https://registry.yarnpkg.com/happo-e2e/-/happo-e2e-2.2.0.tgz#668c5b7db22b915839d38d5e9a68c2b0156cee5b" - integrity sha512-R2RsStFT5DKz6nEayrH7fFM+7nKgbBe+Xycoy9WTHYbcbQVXSEIuS4PtkYD5itIKdnJ4B/s0jpznGzrMPbmD0A== +happo-e2e@^2.2.5: + version "2.2.5" + resolved "https://registry.yarnpkg.com/happo-e2e/-/happo-e2e-2.2.5.tgz#7b2947fa2d965738559201e7289e51068a7f8dc2" + integrity sha512-AD8oy7/3Qt4VuHzySwT1yfq5N3uLUt5g5WAHCNgBOgDz2lifYY+y1osWtuqyM8E+TEDXWC40GHJmVqkPhgdr9A== dependencies: archiver "^5.3.0" base64-stream "^1.0.0" @@ -7332,10 +7333,10 @@ jest@^27.5.1: import-local "^3.0.2" jest-cli "^27.5.1" -joi@^17.7.0: - version "17.8.4" - resolved "https://registry.yarnpkg.com/joi/-/joi-17.8.4.tgz#f2d91ab8acd3cca4079ba70669c65891739234aa" - integrity sha512-jjdRHb5WtL+KgSHvOULQEPPv4kcl+ixd1ybOFQq3rWLgEEqc03QMmilodL0GVJE14U/SQDXkUhQUSZANGDH/AA== +joi@^17.11.0: + version "17.11.0" + resolved "https://registry.yarnpkg.com/joi/-/joi-17.11.0.tgz#aa9da753578ec7720e6f0ca2c7046996ed04fc1a" + integrity sha512-NgB+lZLNoqISVy1rZocE9PZI36bL/77ie924Ri43yEvi9GUUMPeyVIr8KdFTMUlby1p0PBYMk9spIxEUQYqrJQ== dependencies: "@hapi/hoek" "^9.0.0" "@hapi/topo" "^5.0.0" @@ -7961,7 +7962,7 @@ minimist@^1.2.6: resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.7.tgz#daa1c4d91f507390437c6a8bc01078e7000c4d18" integrity sha512-bzfL1YUZsP41gmu/qjrEk0Q6i2ix/cVeAhbCbqH9u3zYutS1cLg00qhrD0M2MVdCcx4Sc0UpP2eBWo9rotpq6g== -minimist@^1.2.7: +minimist@^1.2.8: version "1.2.8" resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.8.tgz#c1a464e7693302e082a075cee0c057741ac4772c" integrity sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA== @@ -9440,10 +9441,10 @@ rxjs@^7.4.0: dependencies: tslib "~2.1.0" -rxjs@^7.8.0: - version "7.8.0" - resolved "https://registry.yarnpkg.com/rxjs/-/rxjs-7.8.0.tgz#90a938862a82888ff4c7359811a595e14e1e09a4" - integrity sha512-F2+gxDshqmIub1KdvZkaEfGDwLNpPvk9Fs6LD/MyQxNgMds/WH9OdDDXOmxUZpME+iSK3rQCctkL0DYyytUqMg== +rxjs@^7.8.1: + version "7.8.1" + resolved "https://registry.yarnpkg.com/rxjs/-/rxjs-7.8.1.tgz#6f6f3d99ea8044291efd92e7c7fcf562c4057543" + integrity sha512-AA3TVj+0A2iuIoQkWEK/tqFjBq2j+6PO6Y0zJcvzLAFhEFIO3HL0vls9hWLncZbAAbK0mar7oZ4V079I/qPMxg== dependencies: tslib "^2.1.0" @@ -10611,16 +10612,16 @@ w3c-xmlserializer@^2.0.0: dependencies: xml-name-validator "^3.0.0" -wait-on@^7.0.1: - version "7.0.1" - resolved "https://registry.yarnpkg.com/wait-on/-/wait-on-7.0.1.tgz#5cff9f8427e94f4deacbc2762e6b0a489b19eae9" - integrity sha512-9AnJE9qTjRQOlTZIldAaf/da2eW0eSRSgcqq85mXQja/DW3MriHxkpODDSUEg+Gri/rKEcXUZHe+cevvYItaog== +wait-on@^7.2.0: + version "7.2.0" + resolved "https://registry.yarnpkg.com/wait-on/-/wait-on-7.2.0.tgz#d76b20ed3fc1e2bebc051fae5c1ff93be7892928" + integrity sha512-wCQcHkRazgjG5XoAq9jbTMLpNIjoSlZslrJ2+N9MxDsGEv1HnFoVjOCexL0ESva7Y9cu350j+DWADdk54s4AFQ== dependencies: - axios "^0.27.2" - joi "^17.7.0" + axios "^1.6.1" + joi "^17.11.0" lodash "^4.17.21" - minimist "^1.2.7" - rxjs "^7.8.0" + minimist "^1.2.8" + rxjs "^7.8.1" walker@^1.0.7: version "1.0.8"