commit suppression changes (#422)

* commit suppression changes

* suppressions

yarn-audit-known-issues

@@ -1 +1 @@
-{"actions":[],"advisories":{"1096303":{"findings":[{"version":"4.4.0","paths":["ioredis>lodash.pick"]}],"metadata":null,"vulnerable_versions":">=4.0.0 <=4.4.0","module_name":"lodash.pick","severity":"high","github_advisory_id":"GHSA-p6mc-m468-83gw","cves":["CVE-2020-8203"],"access":"public","patched_versions":"<0.0.0","cvss":{"score":7.4,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"},"updated":"2024-01-26T15:32:50.000Z","recommendation":"None","cwe":["CWE-770","CWE-1321"],"found_by":null,"deleted":null,"id":1096303,"references":"- https://github.com/lodash/lodash/issues/4744\n- https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12\n- https://nvd.nist.gov/vuln/detail/CVE-2020-8203\n- https://hackerone.com/reports/712065\n- https://github.com/lodash/lodash/issues/4874\n- https://github.com/github/advisory-database/pull/2884\n- https://hackerone.com/reports/864701\n- https://github.com/lodash/lodash/wiki/Changelog#v41719\n- https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744\n- https://security.netapp.com/advisory/ntap-20200724-0006/\n- https://github.com/advisories/GHSA-p6mc-m468-83gw","created":"2020-07-15T19:15:48.000Z","reported_by":null,"title":"Prototype Pollution in lodash","npm_advisory_id":null,"overview":"Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions `pick`, `set`, `setWith`, `update`, `updateWith`, and `zipObjectDeep` allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires manipulating objects based on user-provided property values or arrays.\n\nThis vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.","url":"https://github.com/advisories/GHSA-p6mc-m468-83gw"},"1096820":{"findings":[{"version":"4.18.2","paths":["express"]}],"metadata":null,"vulnerable_versions":"<4.19.2","module_name":"express","severity":"moderate","github_advisory_id":"GHSA-rv95-896h-c2vc","cves":["CVE-2024-29041"],"access":"public","patched_versions":">=4.19.2","cvss":{"score":6.1,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"updated":"2024-03-27T21:47:29.000Z","recommendation":"Upgrade to version 4.19.2 or later","cwe":["CWE-601","CWE-1286"],"found_by":null,"deleted":null,"id":1096820,"references":"- https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc\n- https://github.com/koajs/koa/issues/1800\n- https://github.com/expressjs/express/pull/5539\n- https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd\n- https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94\n- https://expressjs.com/en/4x/api.html#res.location\n- https://nvd.nist.gov/vuln/detail/CVE-2024-29041\n- https://github.com/advisories/GHSA-rv95-896h-c2vc","created":"2024-03-25T19:40:26.000Z","reported_by":null,"title":"Express.js Open Redirect in malformed URLs","npm_advisory_id":null,"overview":"### Impact\n\nVersions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are affected by an open redirect vulnerability using malformed URLs.\n\nWhen a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list.\n\nThe main method impacted is `res.location()` but this is also called from within `res.redirect()`.\n\n### Patches\n\nhttps://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd\nhttps://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94\n\nAn initial fix went out with `[email protected]`, we then patched a feature regression in `4.19.1` and added improved handling for the bypass in `4.19.2`.\n\n### Workarounds\n\nThe fix for this involves pre-parsing the url string with either `require('node:url').parse` or `new URL`. These are steps you can take on your own before passing the user input string to `res.location` or `res.redirect`.\n\n### References\n\nhttps://github.com/expressjs/express/pull/5539\nhttps://github.com/koajs/koa/issues/1800\nhttps://expressjs.com/en/4x/api.html#res.location","url":"https://github.com/advisories/GHSA-rv95-896h-c2vc"},"1097147":{"findings":[{"version":"2.1.2","paths":["@hmcts/nodejs-healthcheck>superagent>formidable"]}],"metadata":null,"vulnerable_versions":"<3.2.4","module_name":"formidable","severity":"critical","github_advisory_id":"GHSA-8cp3-66vr-3r4c","cves":["CVE-2022-29622"],"access":"public","patched_versions":">=3.2.4","cvss":{"score":9.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"updated":"2024-04-22T23:07:51.000Z","recommendation":"Upgrade to version 3.2.4 or later","cwe":["CWE-434"],"found_by":null,"deleted":null,"id":1097147,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2022-29622\n- https://www.youtube.com/watch?v=C6QPKooxhAo\n- https://github.com/node-formidable/formidable/issues/856\n- https://github.com/node-formidable/formidable/pull/857\n- https://gitlab.com/keymandll/blog/-/blob/master/posts/03062022-Invulnerability_Analysis-CVE-2022%E2%80%9329622/index.md\n- https://portswigger.net/daily-swig/researcher-defends-formidable-in-fight-against-critical-cve-vulnerability-assignment\n- https://github.com/advisories/GHSA-8cp3-66vr-3r4c","created":"2022-05-17T00:01:45.000Z","reported_by":null,"title":"Formidable arbitrary file upload","npm_advisory_id":null,"overview":"Disputed: An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename.","url":"https://github.com/advisories/GHSA-8cp3-66vr-3r4c"}},"muted":[],"metadata":{"vulnerabilities":{"info":0,"low":0,"moderate":1,"high":1,"critical":1},"dependencies":163,"devDependencies":0,"optionalDependencies":0,"totalDependencies":163}}
+{"actions":[],"advisories":{"1096303":{"findings":[{"version":"4.4.0","paths":["ioredis>lodash.pick"]}],"metadata":null,"vulnerable_versions":">=4.0.0 <=4.4.0","module_name":"lodash.pick","severity":"high","github_advisory_id":"GHSA-p6mc-m468-83gw","cves":["CVE-2020-8203"],"access":"public","patched_versions":"<0.0.0","cvss":{"score":7.4,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"},"updated":"2024-01-26T15:32:50.000Z","recommendation":"None","cwe":["CWE-770","CWE-1321"],"found_by":null,"deleted":null,"id":1096303,"references":"- https://github.com/lodash/lodash/issues/4744\n- https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12\n- https://nvd.nist.gov/vuln/detail/CVE-2020-8203\n- https://hackerone.com/reports/712065\n- https://github.com/lodash/lodash/issues/4874\n- https://github.com/github/advisory-database/pull/2884\n- https://hackerone.com/reports/864701\n- https://github.com/lodash/lodash/wiki/Changelog#v41719\n- https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744\n- https://security.netapp.com/advisory/ntap-20200724-0006/\n- https://github.com/advisories/GHSA-p6mc-m468-83gw","created":"2020-07-15T19:15:48.000Z","reported_by":null,"title":"Prototype Pollution in lodash","npm_advisory_id":null,"overview":"Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions `pick`, `set`, `setWith`, `update`, `updateWith`, and `zipObjectDeep` allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires manipulating objects based on user-provided property values or arrays.\n\nThis vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.","url":"https://github.com/advisories/GHSA-p6mc-m468-83gw"},"1097548":{"findings":[{"version":"1.10.8","paths":["applicationinsights>@azure/monitor-opentelemetry>@opentelemetry/sdk-node>@opentelemetry/exporter-trace-otlp-grpc>@grpc/grpc-js","applicationinsights>@azure/monitor-opentelemetry>@opentelemetry/sdk-node>@opentelemetry/exporter-trace-otlp-grpc>@opentelemetry/otlp-grpc-exporter-base>@grpc/grpc-js"]}],"metadata":null,"vulnerable_versions":">=1.10.0 <1.10.9","module_name":"@grpc/grpc-js","severity":"moderate","github_advisory_id":"GHSA-7v5v-9h63-cj86","cves":["CVE-2024-37168"],"access":"public","patched_versions":">=1.10.9","cvss":{"score":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"updated":"2024-06-11T21:44:12.000Z","recommendation":"Upgrade to version 1.10.9 or later","cwe":["CWE-789"],"found_by":null,"deleted":null,"id":1097548,"references":"- https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86\n- https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650\n- https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3\n- https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb\n- https://nvd.nist.gov/vuln/detail/CVE-2024-37168\n- https://github.com/advisories/GHSA-7v5v-9h63-cj86","created":"2024-06-10T21:38:05.000Z","reported_by":null,"title":"@grpc/grpc-js can allocate memory for incoming messages well above configured limits","npm_advisory_id":null,"overview":"### Impact\nThere are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option:\n\n 1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded.\n 2. If an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded.\n\n### Patches\n\nThis has been patched in versions 1.10.9, 1.9.15, and 1.8.22\n","url":"https://github.com/advisories/GHSA-7v5v-9h63-cj86"},"1097649":{"findings":[{"version":"2.9.1","paths":["applicationinsights>@azure/identity>@azure/msal-node"]}],"metadata":null,"vulnerable_versions":">=2.7.0 <2.9.2","module_name":"@azure/msal-node","severity":"moderate","github_advisory_id":"GHSA-m5vv-6r4h-3vj9","cves":["CVE-2024-35255"],"access":"public","patched_versions":">=2.9.2","cvss":{"score":5.5,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"updated":"2024-06-19T17:43:19.000Z","recommendation":"Upgrade to version 2.9.2 or later","cwe":["CWE-362"],"found_by":null,"deleted":null,"id":1097649,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2024-35255\n- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255\n- https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499\n- https://github.com/Azure/azure-sdk-for-js/commit/c6aa75d312ae463e744163cedfd8fc480cc8d492\n- https://github.com/Azure/azure-sdk-for-python/commit/cb065acd7d0f957327dc4f02d1646d4e51a94178\n- https://github.com/Azure/azure-sdk-for-java/commit/5bf020d6ea056de40e2738e3647a4e06f902c18d\n- https://github.com/Azure/azure-sdk-for-net/commit/9279a4f38bf69b457cfb9b354f210e0a540a5c53\n- https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340\n- https://github.com/advisories/GHSA-m5vv-6r4h-3vj9","created":"2024-06-11T18:30:50.000Z","reported_by":null,"title":"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability","npm_advisory_id":null,"overview":"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.","url":"https://github.com/advisories/GHSA-m5vv-6r4h-3vj9"},"1097650":{"findings":[{"version":"3.4.2","paths":["applicationinsights>@azure/identity"]}],"metadata":null,"vulnerable_versions":"<4.2.1","module_name":"@azure/identity","severity":"moderate","github_advisory_id":"GHSA-m5vv-6r4h-3vj9","cves":["CVE-2024-35255"],"access":"public","patched_versions":">=4.2.1","cvss":{"score":5.5,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"updated":"2024-06-19T17:43:19.000Z","recommendation":"Upgrade to version 4.2.1 or later","cwe":["CWE-362"],"found_by":null,"deleted":null,"id":1097650,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2024-35255\n- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255\n- https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499\n- https://github.com/Azure/azure-sdk-for-js/commit/c6aa75d312ae463e744163cedfd8fc480cc8d492\n- https://github.com/Azure/azure-sdk-for-python/commit/cb065acd7d0f957327dc4f02d1646d4e51a94178\n- https://github.com/Azure/azure-sdk-for-java/commit/5bf020d6ea056de40e2738e3647a4e06f902c18d\n- https://github.com/Azure/azure-sdk-for-net/commit/9279a4f38bf69b457cfb9b354f210e0a540a5c53\n- https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340\n- https://github.com/advisories/GHSA-m5vv-6r4h-3vj9","created":"2024-06-11T18:30:50.000Z","reported_by":null,"title":"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability","npm_advisory_id":null,"overview":"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.","url":"https://github.com/advisories/GHSA-m5vv-6r4h-3vj9"}},"muted":[],"metadata":{"vulnerabilities":{"info":0,"low":0,"moderate":4,"high":1,"critical":0},"dependencies":301,"devDependencies":0,"optionalDependencies":0,"totalDependencies":301}}