Skip to content

build(deps-dev): bump koa from 2.7.0 to 2.16.1 #158

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

build(deps-dev): bump koa from 2.7.0 to 2.16.1 #158

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Apr 9, 2025

Bumps koa from 2.7.0 to 2.16.1.

Release notes

Sourced from koa's releases.

v2.16.1

fix: don't render redirect values in anchor ref

2.16.0

This is a backported release to fix core underlying issue with HEAD requests when using http2.createSecureServer. See discussion at koajs/koa#1593 and koajs/koa#1547.

  • fix missing cleanup, if response socket is no longer writeable (issue 1547) (koajs/koa#1593) 399cb6b0dd2104224c0ef0ce8e92f84e4f7faf42

2.15.4

Full Changelog: koajs/koa@2.15.3...2.15.4

Fix: avoid redos on host and protocol getter, see GHSA-593f-38f6-jp5m

Changelog

Sourced from koa's changelog.

[!IMPORTANT] Moving forwards we are using the GitHub releases page at https://github.com/koajs/koa/releases in combination with np for publishing releases and their changelogs.

3.0.0-alpha.3 / 2025-02-11

fixes

  • Avoid redos on host and protocol getter

3.0.0-alpha.2 / 2024-11-04

breaking changes

  • Update http-errors to v2.0.0 #1486
  • Remove res.redirect('back'), add back() method to ctx #1115
  • Replace node querystring with URLSearchParams #1828
  • Remove obsolete createAsyncCtxStorageMiddleware #1817

features

  • Add support for web WHATWG #1830

updates

  • Update cookies to ~0.9.1 #1846
  • Update statuses to ^2.0.1
  • Update supertest to ^7.0.0 #1841

fixes

  • Fix exports.defaults in package.json #1630
  • Fix leaky handles in tests #1838
  • Fix body null checks #1814
  • Fix reformatting redirect URLs #1805 #1804
  • Fix passing ctx in error handler #1758

migrations

  • Migrate from jest to the native node test runner #1845

3.0.0-alpha.1 / 2023-04-12

fixes

  • [e98b8d1] - fix: can not get currentContext in error handler (#1758) (Gxkl )

3.0.0-alpha.0 / 2023-01-02

Breaking Changes

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps-dev): bump koa from 2.7.0 to 2.16.1
59a1fe7 
Bumps [koa](https://github.com/koajs/koa) from 2.7.0 to 2.16.1.
- [Release notes](https://github.com/koajs/koa/releases)
- [Changelog](https://github.com/koajs/koa/blob/master/History.md)
- [Commits](koajs/koa@2.7.0...v2.16.1)

---
updated-dependencies:
- dependency-name: koa
  dependency-version: 2.16.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 9, 2025
@dependabot dependabot bot mentioned this pull request Apr 9, 2025
Closed
@ibcheckmarx
Copy link

Logo
Checkmarx One – Scan Summary & Details – 9e23c497-2020-4991-917d-5e39179aca94

New Issues (168)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
CRITICAL CVE-2020-7788 Npm-ini-1.3.5
detailsRecommended version: 1.3.6
Description: This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will p...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2020-7788 Npm-ini-1.3.4
detailsRecommended version: 1.3.6
Description: This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will p...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2021-21353 Npm-pug-code-gen-2.0.0
detailsRecommended version: 3.0.3
Description: In pug-code-gen before version 2.0.3 and 3.x before 3.0.2, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. i...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
CRITICAL CVE-2021-23807 Npm-jsonpointer-4.0.1
detailsRecommended version: 5.0.0
Description: A type confusion vulnerability in jsonpointer can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays. Th...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2021-28918 Npm-netmask-1.0.6
detailsRecommended version: 2.0.1
Description: Improper input validation of octal strings in netmask npm package up to 1.1.0 allows unauthenticated remote attackers to perform indeterminate SSRF...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2021-42740 Npm-shell-quote-1.6.1
detailsRecommended version: 1.7.3
Description: The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex de...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2022-0691 Npm-url-parse-1.4.7
detailsRecommended version: 1.5.9
Description: Authorization Bypass through User-Controlled Key in NPM url-parse versions 1.4.5 through 1.5.8. Bypasses "https://hackerone\.com/reports/496293" via...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2022-25893 Npm-vm2-3.5.0
detailsRecommended version: 3.9.10
Description: The package vm2 prior to 3.9.10 is vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the ''WeakMap.prototype.set'' me...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2022-25893 Npm-vm2-3.6.0
detailsRecommended version: 3.9.10
Description: The package vm2 prior to 3.9.10 is vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the ''WeakMap.prototype.set'' me...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2023-29017 Npm-vm2-3.5.0
detailsRecommended version: 3.9.15
Description: vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2023-29017 Npm-vm2-3.6.0
detailsRecommended version: 3.9.15
Description: vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2023-32314 Npm-vm2-3.5.0
detailsRecommended version: 3.9.18
Description: The NPM package "vm2" is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 in versio...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2023-32314 Npm-vm2-3.6.0
detailsRecommended version: 3.9.18
Description: The NPM package "vm2" is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 in versio...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2023-37903 Npm-vm2-3.6.0
detailsDescription: vm2 is an open source vm/sandbox for Node.js. In vm2 for all versions ,Node.js custom inspect function allows attackers to escape the sandbox and r...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2023-37903 Npm-vm2-3.5.0
detailsDescription: vm2 is an open source vm/sandbox for Node.js. In vm2 for all versions ,Node.js custom inspect function allows attackers to escape the sandbox and r...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2023-45311 Npm-fsevents-1.2.8
detailsRecommended version: 1.2.11
Description: The package fsevents in versions 1.0.0 through 1.2.10 depends on the "https://fsevents\-binaries\.s3\-us\-west\-2\.amazonaws\.com" URL, which might allow ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2023-45311 Npm-fsevents-1.1.1
detailsRecommended version: 1.2.11
Description: The package fsevents in versions 1.0.0 through 1.2.10 depends on the "https://fsevents\-binaries\.s3\-us\-west\-2\.amazonaws\.com" URL, which might allow ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2023-45311 Npm-fsevents-1.1.3
detailsRecommended version: 1.2.11
Description: The package fsevents in versions 1.0.0 through 1.2.10 depends on the "https://fsevents\-binaries\.s3\-us\-west\-2\.amazonaws\.com" URL, which might allow ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2023-45311 Npm-fsevents-1.1.2
detailsRecommended version: 1.2.11
Description: The package fsevents in versions 1.0.0 through 1.2.10 depends on the "https://fsevents\-binaries\.s3\-us\-west\-2\.amazonaws\.com" URL, which might allow ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2023-45311 Npm-fsevents-1.2.7
detailsRecommended version: 1.2.11
Description: The package fsevents in versions 1.0.0 through 1.2.10 depends on the "https://fsevents\-binaries\.s3\-us\-west\-2\.amazonaws\.com" URL, which might allow ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL CVE-2023-45311 Npm-fsevents-1.2.4
detailsRecommended version: 1.2.11
Description: The package fsevents in versions 1.0.0 through 1.2.10 depends on the "https://fsevents\-binaries\.s3\-us\-west\-2\.amazonaws\.com" URL, which might allow ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL Cx6f6f1276-7a2e Npm-tar-4.3.3
detailsRecommended version: 6.2.1
Description: Tar is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file th...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL Cx6f6f1276-7a2e Npm-tar-4.4.1
detailsRecommended version: 6.2.1
Description: Tar is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file th...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL Cx6f6f1276-7a2e Npm-tar-2.2.1
detailsRecommended version: 6.2.1
Description: Tar is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file th...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL Cx9fce0189-774f Npm-handlebars-4.0.10
detailsRecommended version: 4.7.7
Description: handlebars before 3.0.7 and 4.0.x before 4.0.13 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
HIGH CVE-2017-1000048 Npm-qs-2.3.3
detailsRecommended version: 6.2.4
Description: the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil r...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
HIGH CVE-2017-1000048 Npm-qs-6.3.1
detailsRecommended version: 6.3.3
Description: the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil r...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
HIGH CVE-2017-1000048 Npm-qs-6.2.0
detailsRecommended version: 6.2.4
Description: the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil r...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
HIGH CVE-2017-15010 Npm-tough-cookie-2.3.2
detailsRecommended version: 4.1.3
Description: A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
HIGH CVE-2017-16032 Npm-brace-expansion-1.1.6
detailsRecommended version: 1.1.7
Description: Brace-expansion is vulnerable to a Regular Expression Denial of Service (ReDoS) condition in versions prior to 1.1.7.
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
HIGH CVE-2017-16118 Npm-forwarded-0.1.0
detailsRecommended version: 0.1.2
Description: The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of s...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
HIGH CVE-2017-18077 Npm-brace-expansion-1.1.6
detailsRecommended version: 1.1.7
Description: index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argume...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
HIGH CVE-2018-11697 Npm-node-sass-4.5.3
detailsRecommended version: 6.0.1
Description: An issue was discovered in LibSass through 3.5.5. An out-of-bounds read of a memory region was found in the function "Sass::Prelexer::exactly()" wh...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
HIGH CVE-2019-10761 Npm-vm2-3.6.0
detailsRecommended version: 3.6.11
Description: This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by r...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
HIGH CVE-2019-10761 Npm-vm2-3.5.0
detailsRecommended version: 3.6.11
Description: This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by r...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
HIGH CVE-2019-10775 Npm-ecstatic-3.3.1
detailsRecommended version: 4.1.4
Description: ecstatic before 4.1.4 have a denial of service vulnerability. Successful exploitation could lead to crash of an application.
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
HIGH CVE-2019-10775 Npm-ecstatic-3.3.2
detailsRecommended version: 4.1.4
Description: ecstatic before 4.1.4 have a denial of service vulnerability. Successful exploitation could lead to crash of an application.
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
HIGH CVE-2019-13173 Npm-fstream-1.0.11
detailsRecommended version: 1.0.12
Description: fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the sys...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
HIGH CVE-2019-13173 Npm-fstream-1.0.10
detailsRecommended version: 1.0.12
Description: fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the sys...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
HIGH CVE-2020-26237 Npm-highlight.js-9.12.0
detailsRecommended version: 10.4.1
Description: Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
HIGH CVE-2020-7660 Npm-serialize-javascript-1.6.1
detailsRecommended version: 6.0.2
Description: serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
HIGH CVE-2020-7660 Npm-serialize-javascript-1.5.0
detailsRecommended version: 6.0.2
Description: serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
HIGH CVE-2020-7660 Npm-serialize-javascript-1.7.0
detailsRecommended version: 6.0.2
Description: serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package

More results are available on the CxOne platform

Fixed Issues (194)
Great job! The following issues were fixed in this Pull Request

Severity Issue Source File / Package
CRITICAL CVE-2018-13797 Npm-macaddress-0.2.8
CRITICAL CVE-2018-3745 Npm-atob-2.0.3
CRITICAL CVE-2019-10196 Npm-http-proxy-agent-1.0.0
CRITICAL CVE-2019-10744 Npm-lodash-4.17.5
CRITICAL CVE-2019-10744 Npm-lodash-4.17.10
CRITICAL CVE-2019-10744 Npm-lodash.defaultsdeep-4.3.2
CRITICAL CVE-2019-10744 Npm-lodash.defaultsdeep-4.6.0
CRITICAL CVE-2019-10744 Npm-lodash-4.17.11
CRITICAL CVE-2019-10744 Npm-lodash-3.10.1
CRITICAL CVE-2019-10744 Npm-lodash-4.17.4
CRITICAL CVE-2019-10746 Npm-mixin-deep-1.3.1
CRITICAL CVE-2020-7774 Npm-y18n-3.2.1
CRITICAL CVE-2020-7774 Npm-y18n-4.0.0
CRITICAL CVE-2021-23369 Npm-handlebars-4.1.2
CRITICAL CVE-2021-23369 Npm-handlebars-4.0.10
CRITICAL CVE-2021-23383 Npm-handlebars-4.1.2
CRITICAL CVE-2021-23383 Npm-handlebars-4.0.10
CRITICAL CVE-2021-23449 Npm-vm2-3.6.0
CRITICAL CVE-2021-23449 Npm-vm2-3.5.0
CRITICAL CVE-2021-25949 Npm-set-getter-0.1.0
CRITICAL CVE-2022-1650 Npm-eventsource-0.1.6
CRITICAL CVE-2022-1650 Npm-eventsource-1.0.7
CRITICAL CVE-2022-29078 Npm-ejs-2.6.1
CRITICAL CVE-2022-29078 Npm-ejs-2.5.7
CRITICAL CVE-2022-36067 Npm-vm2-3.5.0
CRITICAL CVE-2022-36067 Npm-vm2-3.6.0
CRITICAL CVE-2023-26136 Npm-tough-cookie-2.3.3
CRITICAL CVE-2023-26136 Npm-tough-cookie-2.5.0
CRITICAL CVE-2023-26136 Npm-tough-cookie-2.4.3
CRITICAL CVE-2023-26136 Npm-tough-cookie-2.3.2
CRITICAL CVE-2023-29199 Npm-vm2-3.6.0
CRITICAL CVE-2023-29199 Npm-vm2-3.5.0
CRITICAL CVE-2023-37466 Npm-vm2-3.6.0
CRITICAL CVE-2023-37466 Npm-vm2-3.5.0
CRITICAL CVE-2024-40643 Npm-htmlparser2-3.3.0
CRITICAL CVE-2024-40643 Npm-htmlparser2-3.9.2
CRITICAL CVE-2024-40643 Npm-htmlparser2-3.10.1
CRITICAL CVE-2024-48949 Npm-elliptic-6.4.0
CRITICAL CVE-2024-48949 Npm-elliptic-6.4.1
CRITICAL Cx29ea9bf3-a8eb Npm-macaddress-0.2.8
CRITICAL Cx5ec2f1d8-1b0c Npm-urijs-1.18.12
CRITICAL Cx88b46a98-47a5 Npm-elliptic-6.4.1
CRITICAL Cx88b46a98-47a5 Npm-elliptic-6.4.0
HIGH CVE-2017-11342 Npm-node-sass-4.5.3
HIGH CVE-2017-11555 Npm-node-sass-4.5.3
HIGH CVE-2017-12963 Npm-node-sass-4.5.3
HIGH CVE-2018-20834 Npm-tar-2.2.1
HIGH CVE-2018-20834 Npm-tar-4.3.3
HIGH CVE-2018-20834 Npm-tar-4.4.1
HIGH CVE-2018-3737 Npm-sshpk-1.11.0
HIGH CVE-2018-3737 Npm-sshpk-1.13.0
HIGH CVE-2018-3737 Npm-sshpk-1.10.2
HIGH CVE-2018-3737 Npm-sshpk-1.13.1
HIGH CVE-2019-20149 Npm-kind-of-6.0.2
HIGH CVE-2020-36048 Npm-engine.io-3.2.1
HIGH CVE-2020-36049 Npm-socket.io-parser-3.2.0
HIGH CVE-2020-8203 Npm-lodash-4.17.10
HIGH CVE-2020-8203 Npm-lodash-4.17.11
HIGH CVE-2020-8203 Npm-lodash-4.17.4
HIGH CVE-2020-8203 Npm-lodash-4.17.5
HIGH CVE-2020-8203 Npm-lodash-3.10.1
HIGH CVE-2021-23424 Npm-ansi-html-0.0.7
HIGH CVE-2021-28092 Npm-is-svg-3.0.0
HIGH CVE-2021-28092 Npm-is-svg-2.1.0
HIGH CVE-2022-21681 Npm-marked-0.3.19
HIGH CVE-2022-24772 Npm-node-forge-0.10.0
HIGH CVE-2022-24772 Npm-node-forge-0.6.33
HIGH CVE-2022-24772 Npm-node-forge-0.7.5
HIGH CVE-2022-29167 Npm-hawk-6.0.2
HIGH CVE-2022-29167 Npm-hawk-3.1.3
HIGH CVE-2022-3517 Npm-minimatch-3.0.4
HIGH CVE-2022-3517 Npm-minimatch-3.0.3
HIGH CVE-2022-37620 Npm-html-minifier-3.5.8
HIGH CVE-2022-37620 Npm-html-minifier-3.5.21
HIGH CVE-2022-37620 Npm-html-minifier-3.5.16
HIGH CVE-2022-37620 Npm-html-minifier-3.5.5
HIGH CVE-2022-46175 Npm-json5-0.5.1
HIGH CVE-2022-46175 Npm-json5-1.0.1
HIGH CVE-2022-46175 Npm-json5-2.1.0
HIGH CVE-2023-26156 Npm-chromedriver-2.46.0
HIGH CVE-2024-29180 Npm-webpack-dev-middleware-1.12.2
HIGH CVE-2024-29180 Npm-webpack-dev-middleware-1.10.1
HIGH CVE-2024-29180 Npm-webpack-dev-middleware-1.12.0
HIGH CVE-2024-29180 Npm-webpack-dev-middleware-2.0.5
HIGH CVE-2024-29180 Npm-webpack-dev-middleware-3.4.0
HIGH CVE-2024-29180 Npm-webpack-dev-middleware-2.0.6
HIGH CVE-2024-29180 Npm-webpack-dev-middleware-3.6.0
HIGH CVE-2024-29180 Npm-webpack-dev-middleware-3.6.2
HIGH CVE-2024-4068 Npm-braces-0.1.5
HIGH CVE-2024-4068 Npm-braces-2.3.2
HIGH CVE-2024-4068 Npm-braces-2.3.0
HIGH CVE-2024-4068 Npm-braces-1.8.5
HIGH Cx2a483c11-ee9d Npm-underscore.string-2.3.3
HIGH Cx2d55b83a-7aa0 Npm-braces-2.3.0
HIGH Cx2d55b83a-7aa0 Npm-braces-1.8.5
HIGH Cx2d55b83a-7aa0 Npm-braces-0.1.5
HIGH Cx3f1b0502-ac0d Npm-console-browserify-1.1.0
HIGH Cxa8a11659-1098 Npm-tunnel-agent-0.4.3
HIGH Cxb5ff3426-7838 Npm-handlebars-4.0.10
HIGH Cxb5ff3426-7838 Npm-handlebars-4.1.2
HIGH Cxe299c2b0-ccc8 Npm-domutils-1.1.6
HIGH Cxe299c2b0-ccc8 Npm-domutils-1.5.1
HIGH Cxe578f4ea-ca81 Npm-constantinople-3.1.0
MEDIUM CVE-2017-16137 Npm-debug-2.6.1
MEDIUM CVE-2017-16137 Npm-debug-2.6.3
MEDIUM CVE-2017-16137 Npm-debug-0.7.4
MEDIUM CVE-2017-16137 Npm-debug-2.2.0
MEDIUM CVE-2017-16137 Npm-debug-2.6.8
MEDIUM CVE-2017-16137 Npm-debug-3.0.1
MEDIUM CVE-2018-20821 Npm-node-sass-4.5.3
MEDIUM CVE-2018-3718 Npm-serve-6.1.0
MEDIUM CVE-2019-16769 Npm-serialize-javascript-1.9.1
MEDIUM CVE-2019-16769 Npm-serialize-javascript-1.6.1
MEDIUM CVE-2019-16769 Npm-serialize-javascript-1.5.0
MEDIUM CVE-2019-16769 Npm-serialize-javascript-1.4.0
MEDIUM CVE-2019-16769 Npm-serialize-javascript-1.7.0
MEDIUM CVE-2019-18797 Npm-node-sass-4.5.3
MEDIUM CVE-2019-6286 Npm-node-sass-4.5.3
MEDIUM CVE-2020-15366 Npm-ajv-6.5.1
MEDIUM CVE-2020-15366 Npm-ajv-6.1.1
MEDIUM CVE-2020-15366 Npm-ajv-5.5.2
MEDIUM CVE-2020-15366 Npm-ajv-6.10.0
MEDIUM CVE-2020-15366 Npm-ajv-4.11.8
MEDIUM CVE-2020-15366 Npm-ajv-5.2.2
MEDIUM CVE-2020-15366 Npm-ajv-6.9.1
MEDIUM CVE-2020-15366 Npm-ajv-4.11.3
MEDIUM CVE-2020-15366 Npm-ajv-4.11.5
MEDIUM CVE-2020-7598 Npm-minimist-0.0.10
MEDIUM CVE-2020-7598 Npm-minimist-0.0.8
MEDIUM CVE-2020-7598 Npm-minimist-1.2.0
MEDIUM CVE-2020-8124 Npm-url-parse-1.0.5
MEDIUM CVE-2020-8124 Npm-url-parse-1.4.4
MEDIUM CVE-2020-8124 Npm-url-parse-1.1.9
MEDIUM CVE-2020-8124 Npm-url-parse-1.1.8
MEDIUM CVE-2020-8244 Npm-bl-1.2.2
MEDIUM CVE-2021-23362 Npm-hosted-git-info-2.6.0
MEDIUM CVE-2021-23362 Npm-hosted-git-info-2.2.0
MEDIUM CVE-2021-23362 Npm-hosted-git-info-2.7.1
MEDIUM CVE-2021-23362 Npm-hosted-git-info-2.5.0
MEDIUM CVE-2021-23364 Npm-browserslist-4.4.1
MEDIUM CVE-2021-23364 Npm-browserslist-4.5.5
MEDIUM CVE-2021-23386 Npm-dns-packet-1.3.1
MEDIUM CVE-2021-23386 Npm-dns-packet-1.2.2
MEDIUM CVE-2021-3801 Npm-prismjs-1.16.0
MEDIUM CVE-2022-0122 Npm-node-forge-0.7.5
MEDIUM CVE-2022-0122 Npm-node-forge-0.10.0
MEDIUM CVE-2022-0122 Npm-node-forge-0.6.33
MEDIUM CVE-2022-0437 Npm-karma-3.1.4
MEDIUM CVE-2022-21670 Npm-markdown-it-8.4.2
MEDIUM CVE-2022-21670 Npm-markdown-it-6.1.1
MEDIUM CVE-2022-21704 Npm-log4js-3.0.6
MEDIUM CVE-2022-23647 Npm-prismjs-1.16.0
MEDIUM CVE-2022-41940 Npm-engine.io-3.2.1
MEDIUM CVE-2023-28155 Npm-request-2.88.2
MEDIUM CVE-2023-28155 Npm-request-2.79.0
MEDIUM CVE-2023-28155 Npm-request-2.88.0
MEDIUM CVE-2023-28155 Npm-request-2.82.0
MEDIUM CVE-2023-28155 Npm-request-2.81.0
MEDIUM CVE-2024-28863 Npm-tar-4.4.8
MEDIUM CVE-2024-28863 Npm-tar-2.2.1
MEDIUM CVE-2024-28863 Npm-tar-4.3.3
MEDIUM CVE-2024-28863 Npm-tar-4.4.1
MEDIUM CVE-2024-42459 Npm-elliptic-6.4.1
MEDIUM CVE-2024-42459 Npm-elliptic-6.4.0
MEDIUM CVE-2024-43799 Npm-send-0.15.1
MEDIUM CVE-2024-43799 Npm-send-0.15.5
MEDIUM CVE-2024-43799 Npm-send-0.14.2
MEDIUM CVE-2024-43799 Npm-send-0.16.1
MEDIUM CVE-2024-43799 Npm-send-0.15.4
MEDIUM CVE-2024-43799 Npm-send-0.16.2
MEDIUM CVE-2024-53382 Npm-prismjs-1.16.0
MEDIUM CVE-2024-6783 Npm-vue-template-compiler-2.6.10
MEDIUM CVE-2024-6783 Npm-vue-template-compiler-2.1.10
MEDIUM CVE-2024-6783 Npm-vue-template-compiler-2.5.13
MEDIUM CVE-2024-6783 Npm-vue-template-compiler-2.7.16
MEDIUM CVE-2024-6783 Npm-vue-template-compiler-2.5.16
MEDIUM CVE-2024-6783 Npm-vue-template-compiler-2.2.4
MEDIUM CVE-2024-6783 Npm-vue-template-compiler-2.6.6
MEDIUM CVE-2024-6783 Npm-vue-template-compiler-2.4.4
MEDIUM Cx37ebdf56-bc4d Npm-eslint-4.7.2
MEDIUM Cx37ebdf56-bc4d Npm-eslint-3.19.0
LOW Cx8bc4df28-fcf5 Npm-debug-2.6.8

More results are available on the CxOne platform

@dependabot Dependabot
Copy link
Author

dependabot bot commented on behalf of github Jul 29, 2025

Superseded by #165.

@dependabot dependabot bot closed this Jul 29, 2025
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/koa-2.16.1 branch July 29, 2025 09:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ibcheckmarx