Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Upgrade: , axios, gauge, web3 #1

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Upgrade: , axios, gauge, web3 #1

wants to merge 1 commit into from

Conversation

AKJUS
Copy link
Owner

@AKJUS AKJUS commented Sep 12, 2024

snyk-top-banner

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name Versions Released on

@polkadot/api
from 10.11.2 to 10.13.1 | 8 versions ahead of your current version | 5 months ago
on 2024-04-16
axios
from 1.6.5 to 1.7.4 | 11 versions ahead of your current version | a month ago
on 2024-08-13
gauge
from 5.0.1 to 5.0.2 | 1 version ahead of your current version | 4 months ago
on 2024-05-04
web3
from 4.3.0 to 4.11.1 | 154 versions ahead of your current version | 2 months ago
on 2024-07-24

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Server-side Request Forgery (SSRF)
SNYK-JS-AXIOS-7361793		 761 Proof of Concept
high severity Prototype Pollution
SNYK-JS-WEB3UTILS-6229337		 761 Proof of Concept
high severity Denial of Service (DoS)
SNYK-JS-WS-7266574		 761 Proof of Concept
medium severity Information Exposure
SNYK-JS-FOLLOWREDIRECTS-6444610		 761 Proof of Concept
Release notes
Package name: @polkadot/api
  • 10.13.1 - 2024-04-16

    Changes:

    • Update CI actions and setup_node to v4
    • Update substrate metadata to latest
    • Support ParachainHost runtime api v6, 7, 8, 9, 10
    • Resolve correct module for council derive
    • Update westend types-known for 1010000
    • Update kusama types-known for 1001003
  • 10.12.6 - 2024-04-03

    NOTE: Because of a broken CI build for 10.12.5 -> 10.12.6 is a replacement

    Contributed:

    Changes:

    • Upgrade westend types-known for 1009000
    • Add disableAscii option for toHuman, and toPrimitive
    • V14 Update substrate latest metadata
    • V15 Update substrate latest metadata
    • Bump yarn to 4.1.1
    • Add assetId getter field to to necessary ExtrinsicPayloads
    • Add Updated Runtime Defintions
      • ValidateStatement
      • MMRApi
        • mmr_root
        • mmr_leaf_count
      • Core v5
      • GenesisBuilder
      • MixnetApi
  • 10.12.5 - 2024-04-02

    Contributed:

    Changes:

    • Upgrade westend types-known for 1009000
    • Add disableAscii option for toHuman, and toPrimitive
    • V14 Update substrate latest metadata
    • V15 Update substrate latest metadata
    • Bump yarn to 4.1.1
    • Add assetId getter field to to necessary ExtrinsicPayloads
    • Add Updated Runtime Defintions
      • ValidateStatement
      • MMRApi
        • mmr_root
        • mmr_leaf_count
      • Core v5
      • GenesisBuilder
      • MixnetApi
  • 10.12.4 - 2024-03-19

    Contributed:

  • 10.12.3 - 2024-03-18

    Contributed:

    Changes:

    • Fix api.derive.staking.eraExposure for compatibility
    • Fix invalid Lookup assignment on augmentation and update polkadot and kusama metadata
    • Update polkadot runtime upgrade per block
    • Update kusama runtime upgrade per block
    • Update westend runtime upgrade per block
  • 10.12.2 - 2024-03-11

    Contributed:

    Changes:

    • Update to latest Substrate metadata
  • 10.12.1 - 2024-03-04

    Contributed:

  • 10.11.3 - 2024-02-27

    Contributed:

    Changes:

    • Bump dev w/ packageDetect adjustments
    • Update copyright year
    • Bump nock, and dev deps
    • Allow cacheCapacity option for the WsProvider
    • Bump yarn
  • 10.11.2 - 2023-12-18

    Contributed:

    Changes:

    • Support [8a;32] types in known keys
    • Update to latest Substrate metadata
from @polkadot/api GitHub release notes
Package name: axios from axios GitHub release notes
Package name: gauge from gauge GitHub release notes
Package name: web3
  • 4.11.1 - 2024-07-24

    [4.11.1]

    Fixed

    web3-errors

    • Fixed the undefined data in Eip838ExecutionError constructor (#6905)

    web3-eth

    • Adds transaction property to be an empty list rather than undefined when no transactions are included in the block (#7151)
    • Change method getTransactionReceipt to not be casted as TransactionReceipt to give proper return type (#7159)

    web3

    • Remove redundant constructor of contractBuilder (#7150)

    What's Changed

    New Contributors

    Full Changelog: v4.11.0...v4.11.1

  • 4.11.1-dev.e5efe49.0 - 2024-07-22
  • 4.11.1-dev.cbcfc18.0 - 2024-07-22
  • 4.11.1-dev.9afaa61.0 - 2024-07-16
  • 4.11.1-dev.6b80cf0.0 - 2024-07-12
  • 4.11.1-dev.5f6deeb.0 - 2024-07-22
  • 4.11.1-dev.5ad7e5b.0 - 2024-07-17
  • 4.11.1-dev.463d070.0 - 2024-07-11
  • 4.11.0 - 2024-07-11

    [4.11.0]

    Fixed

    web3-eth-abi

    • fix encodedata in EIP-712 (#7095)

    web3-utils

    • _sendPendingRequests will catch unhandled errors from _sendToSocket (#6968)

    web3-eth

    • Fixed geth issue when running a new instance, transactions will index when there are no blocks created (#7098)

    Changed

    web3-eth-accounts

    • baseTransaction method updated (#7095)

    web3-providers-ws

    • Update dependancies (#7109)

    web3-rpc-providers

    • Change request return type Promise<ResultType> to Promise<JsonRpcResponseWithResult<ResultType>> (#7102)

    Added

    web3-eth-contract

    • populateTransaction was added to contract methods (#7124)
    • Contract has setTransactionMiddleware and getTransactionMiddleware for automatically passing to sentTransaction for deploy and send functions (#7138)

    web3-rpc-providers

    • When error is returned with code 429, throw rate limit error (#7102)

    web3

    • web3.eth.Contract will get transaction middleware and use it, if web3.eth has transaction middleware. (#7138)
  • 4.10.1-dev.89711ab.0 - 2024-07-10
  • 4.10.1-dev.1436228.0 - 2024-07-09
  • 4.10.0 - 2024-06-17

    [4.10.0]

    Added

    web3

    • Now when existing packages are added in web3, will be avalible for plugins via context. (#7088)

    web3-core

    • Now when existing packages are added in web3, will be avalible for plugins via context. (#7088)

    web3-eth

    • sendTransaction in rpc_method_wrappers accepts optional param of TransactionMiddleware (#7088)
    • WebEth has setTransactionMiddleware and getTransactionMiddleware for automatically passing to sentTransaction (#7088)

    web3-eth-ens

    • getText now supports first param Address
    • getName has optional second param checkInterfaceSupport

    web3-types

    • Added result as optional never and error as optional never in type JsonRpcNotification` (#7091)
    • Added JsonRpcNotfication as a union type in JsonRpcResponse (#7091)

    web3-rpc-providers

    • Alpha release

    Fixed

    web3-eth-ens

    • getName reverse resolution

    What's Changed

    Full Changelog: v4.9.0...v4.10.0

  • 4.9.1-dev.fd2982d.0 - 2024-05-23
  • 4.9.1-dev.f687df6.0 - 2024-05-29
  • 4.9.1-dev.b63af9f.0 - 2024-05-30
  • 4.9.1-dev.962b99f.0 - 2024-05-24
  • 4.9.1-dev.9086b98.0 - 2024-05-30
  • 4.9.1-dev.7537f03.0 - 2024-05-23
  • 4.9.1-dev.692987a.0 - 2024-05-24
  • 4.9.1-dev.683be62.0 - 2024-05-28
  • 4.9.1-dev.22c07ad.0 - 2024-05-27
  • 4.9.1-dev.7084665.0 - 2024-05-29
  • 4.9.0 - 2024-05-23

    What's Changed

@snyk-bot
fix: upgrade multiple dependencies with Snyk
5f3317d 
Snyk has created this PR to upgrade:
  - @polkadot/api from 10.11.2 to 10.13.1.
    See this package in npm: https://www.npmjs.com/package/@polkadot/api
  - axios from 1.6.5 to 1.7.4.
    See this package in npm: https://www.npmjs.com/package/axios
  - gauge from 5.0.1 to 5.0.2.
    See this package in npm: https://www.npmjs.com/package/gauge
  - web3 from 4.3.0 to 4.11.1.
    See this package in npm: https://www.npmjs.com/package/web3

See this project in Snyk:
https://app.snyk.io/org/akjus/project/d095e41e-16d4-4453-bf38-cfc2ca9e5524?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@AKJUS @snyk-bot