From c386288ff6bc1a45672ae45560a0ada550b790cd Mon Sep 17 00:00:00 2001 From: Snyk Community Date: Thu, 6 Oct 2016 14:18:40 +0300 Subject: [PATCH] Fix for 4 vulnerable dependency paths genesis-wordpress currently has a 15 vulnerable dependency paths, introducing 7 different types of known vulnerabilities. his PR fixes vulnerable dependencies, introducing [remote memory exposure ](https://snyk.io/vuln/npm:request:20160119) vulnerability in the `request` dependency, [ReDos vulnerability](https://snyk.io/vuln/npm:hawk:20160119) in the `hawk` dependency,[Dos(Memory Exhaustion) vulnerability](https://snyk.io/vuln/npm:qs:20140806) and [Dos(Event Loop Blocking) vulnerability](https://snyk.io/vuln/npm:qs:20140806-1) in the `qs` dependency. You can see [Snyk test report](https://snyk.io/test/github/evolution/genesis-wordpress) of this project for details. This PR changes `Package.json` to upgrade `request` to the newer 2.74.0 version, and will fix the vulnerability listed above. You can get alerts and fix PRs for future vulnerabilities for free by [watching this repo with Snyk](https://snyk.io/add). Note this PR fixes all the vulnerabilities introduced trough `request` dependency, in order to be vulnerability free you will need to upgrade other dependencies as well. Full disclosure: I'm a part of the Snyk team, just looking to spread some security goodness and awareness ;) --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index a297f41..dec150d 100644 --- a/package.json +++ b/package.json @@ -8,7 +8,7 @@ "chalk": "~0.3.0", "fs-extra": "~0.8.1", "github-latest": "~0.1.2", - "request": "~2.27.0", + "request": "~2.74.0", "ssh-keygen": "~0.2.1", "yeoman-generator": "~0.14.0-rc.1" },