Skip to content

Commit b2209b0

Browse files
esarafianouMike Lee
authored andcommitted
Update dependencies reported as vulnerable in Snyk (#146)
* Update adm-zip to non vuln version * Update ws to non vulnerable version * Update connect-multiparty to non vuln version * Update leveldown to non vulnerable version * Update express to a non vulnerable version * Update jsonwebtoken to non vulnerable version * Update morgan to non vulnerable version * Remove unused cookie-session dependency * Update selfsigned to non vulnerable version * Update request to a non vulnerable version * Update wsfed to a non vulnerable version * Ignore snyk false positives * Fix options in cookie-sessions * Update express-session to non vulnerable version * Update body-parser to non vulnerable version * Update win-ca to non vulnerable version
1 parent c568ed5 commit b2209b0

File tree

4 files changed

+1209
-920
lines changed

4 files changed

+1209
-920
lines changed

.snyk

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
2+
version: v1.12.0
3+
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
4+
ignore:
5+
'npm:base64url:20180511':
6+
- '*':
7+
reason: The vulnerability is for Node <=4 but we're in Node 8
8+
expires: '2019-11-19T12:18:32.458Z'
9+
'npm:chownr:20180731':
10+
- leveldown > prebuild-install > tar-fs > chownr:
11+
reason: >-
12+
The vulnerable package is not used during runtime, only when
13+
installing
14+
expires: '2019-11-19T13:55:05.888Z'
15+
'npm:deep-extend:20180409':
16+
- leveldown > prebuild-install > rc > deep-extend:
17+
reason: >-
18+
The vulnerable package is not used during runtime, only when
19+
installing
20+
expires: '2019-11-19T13:55:05.888Z'
21+
'snyk:lic:npm:xmldom:LGPL-3.0':
22+
- wsfed > saml > xml-crypto > xmldom:
23+
reason: >-
24+
The LICENSE file in xmldom GitHub repo suggests one can choose between MIT and
25+
LGPL-3. The MIT one is compliant with our repo
26+
expires: '2019-01-19T14:12:04.030Z'
27+
- wsfed > saml > xmldom:
28+
reason: >-
29+
The LICENSE file in xmldom GitHub repo suggests one can choose between MIT and
30+
LGPL-3. The MIT one is compliant with our repo
31+
expires: '2019-01-19T14:12:04.030Z'
32+
- wsfed > saml > xml-encryption > xmldom:
33+
reason: >-
34+
The LICENSE file in xmldom GitHub repo suggests one can choose between MIT and
35+
LGPL-3. The MIT one is compliant with our repo
36+
expires: '2019-01-19T14:12:04.030Z'
37+
patch: {}

0 commit comments

Comments
 (0)