Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Upgrade solhint from 1.5.1 to 5.0.3 #5

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

HaLaGu1L
Copy link
Owner

@HaLaGu1L HaLaGu1L commented Nov 3, 2024

snyk-top-banner

Snyk has created this PR to upgrade solhint from 1.5.1 to 5.0.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

  • The recommended version is 51 versions ahead of your current version.

  • The recommended version was released on 3 months ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Asymmetric Resource Consumption (Amplification)
SNYK-JS-BODYPARSER-7926860
63 No Known Exploit
high severity Improper Verification of Cryptographic Signature
SNYK-JS-BROWSERIFYSIGN-6037026
63 No Known Exploit
high severity Denial of Service (DoS)
SNYK-JS-DECODEURICOMPONENT-3149970
63 Proof of Concept
high severity Prototype Pollution
SNYK-JS-Y18N-1021887
63 Proof of Concept
high severity Prototype Pollution
SNYK-JS-JSONSCHEMA-1920922
63 No Known Exploit
high severity Prototype Poisoning
SNYK-JS-QS-3153490
63 Proof of Concept
high severity Improper Validation of Integrity Check Value
SNYK-JS-SECP256K1-8237220
63 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795
63 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795
63 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ES5EXT-6095076
63 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-GETFUNCNAME-5923417
63 Proof of Concept
high severity Remote Code Execution (RCE)
SNYK-JS-HANDLEBARS-1056767
63 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHPARSE-1077067
63 Proof of Concept
medium severity Cross-site Scripting (XSS)
SNYK-JS-COOKIE-8163060
63 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818
63 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-UGLIFYJS-1727251
63 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHTOREGEXP-7925106
63 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-PATHVAL-596926
63 Proof of Concept
medium severity Open Redirect
SNYK-JS-EXPRESS-6474509
63 No Known Exploit
medium severity Cross-site Scripting
SNYK-JS-EXPRESS-7926867
63 No Known Exploit
medium severity Prototype Pollution
SNYK-JS-HANDLEBARS-1279029
63 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-HOSTEDGITINFO-1088355
63 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-HTTPCACHESEMANTICS-3248783
63 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-WORDWRAP-3149973
63 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
npm:debug:20170905
63 Proof of Concept
low severity Cross-site Scripting
SNYK-JS-SEND-7926862
63 No Known Exploit
low severity Cross-site Scripting
SNYK-JS-SERVESTATIC-7926865
63 No Known Exploit
Release notes
Package name: solhint
  • 5.0.3 - 2024-08-03

    [5.0.3] - 2024-08-03

    Fixed

    • New Rule: Imports order #593
  • 5.0.2 - 2024-07-25

    [5.0.2] - 2024-07-25

    Fixed

    Added

    • New Rule: Imports order #587
  • 5.0.1 - 2024-05-13

    [5.0.1] - 2024-05-13

    BREAKING CHANGES (refer to v5.0.0)

    Fixed an issue on the returining values where only was evaluating the first report instead of all of them.

  • 5.0.0 - 2024-05-11

    [5.0.0] - 2024-05-11

    BREAKING CHANGES

    Solhint EXIT codes

    Solhint changed how the exit codes are implemented:

    Exit with 0 code When execution was ok and there were no errors when evaluating the code according to the rules
    Exit with 1 code When execution was ok and there are errors reported
    Exit with 1 code When execution was ok and max warnings is lower than the reported warnings
    Exit with 255 code When there's an error in the execution (bad config, writing not allowed, wrong parameter, file not found, etc)

    Solhint QUIET mode

    QUIET mode (-c quiet) option now works with the warnings and may exit with 1 if there are more than defined by user




    Thanks to @ juanpcapurro for providing the code

  • 4.5.4 - 2024-04-10

    [4.5.4] - 2024-04-10

    Fixed

    • gas-custom-errors improved logic to ranged pragma versions #573
    • gas-indexed-events #573
  • 4.5.3 - 2024-04-10
  • 4.5.2 - 2024-03-15

    [4.5.2] - 2024-03-15

    Updated

    • Update Readme file to include all autofix rules
    • Update docker file
    • Update package json file

    [4.5.0] - 2024-03-15

    Updated

    • Update dependencies in package json #548
    • Custom errors rules checks from 0.8.4 forward before warning #555
    • Parser support up to Solidity 0.8.22 (*)

    (*) Note: Solhint can work with latest Solidity versions.
    If new grammar/syntax is added or changed, it could give some false positives or miss a rule.
    But overall functionality will work as expected.

    Added

    • New Rule: Interface starts with i #557

    Gas Consumption Rules

    • New Rule: [GC] Mutlitoken1155 rule #541
    • New Rule: [GC] Small strings check #542
    • New Rule: [GC] Indexed events #543
    • New Rule: [GC] Calldata parameters #544
    • New Rule: [GC] Increment by one #545
    • New Rule: [GC] Struct packing #546
    • New Rule: [GC] Name Return Values #552
    • New Rule: [GC] Custom Errors #553 #555
    • New Rule: [GC] Dot Length in Loops #559
    • New Rule: [GC] Gas Strict Inequalities #560

    Fixed

    • explicit-types logic improved and bug free #551
    • payable fallback Improved behavior #561

    BREAKING CHANGES

    • named-return-values rule was renamed to gas-named-return-values and now it is part of Gas Consumption ruleset #552
    • custom-errors rule was renamed to gas-custom-errors and now it is part of Gas Consumption ruleset #553
    • Return error 0 when executed correctly #554
    • Default severity modified to WARN instead of OFF for
      foundry-test-functions and named-parameters-mapping rules #556
  • 4.5.1 - 2024-03-15
  • 4.5.0 - 2024-03-15

    Updated

    • Update dependencies in package json #548
    • Custom errors rules checks from 0.8.4 forward before warning #555
    • Parser support up to Solidity 0.8.22 (*)

    (*) Note: Solhint can work with latest Solidity versions.
    If new grammar/syntax is added or changed, it could give some false positives or miss a rule.
    But overall functionality will work as expected.

    Added

    • New Rule: Interface starts with i #557

    Gas Consumption Rules

    • New Rule: [GC] Mutlitoken1155 rule #541
    • New Rule: [GC] Small strings check #542
    • New Rule: [GC] Indexed events #543
    • New Rule: [GC] Calldata parameters #544
    • New Rule: [GC] Increment by one #545
    • New Rule: [GC] Struct packing #546
    • New Rule: [GC] Name Return Values #552
    • New Rule: [GC] Custom Errors #553 #555
    • New Rule: [GC] Dot Length in Loops #559
    • New Rule: [GC] Gas Strict Inequalities #560

    Fixed

    • explicit-types logic improved and bug free #551
    • payable fallback Improved behavior #561

    BREAKING CHANGES

    • named-return-values rule was renamed to gas-named-return-values and now it is part of Gas Consumption ruleset #552
    • custom-errors rule was renamed to gas-custom-errors and now it is part of Gas Consumption ruleset #553
    • Return error 0 when executed correctly #554
    • Default severity modified to WARN instead of OFF for
      foundry-test-functions and named-parameters-mapping rules #556
  • 4.1.1 - 2024-01-08

    [4.1.1] - 2024-01-08

    Fixed

    • Fix changelog typos

    [4.1.0] - 2024-01-08

    Updated

    Added

    • Official Docker Image #524 (Thanks to @ keypee)
    • Autofix for payable-fallback rule #528
    • Autofix for quotes rule #529
    • Autofix for avoid-suicide rule #531
    • Autofix for contract-name-camelcase rule #532
    • Autofix for event-name-camelcase rule #533

    Fixed

    • Fix private vars leading underscore on libraries #525
  • 4.1.0 - 2024-01-08
  • 4.0.0 - 2023-10-27

    JOIN OUR DISCORD SERVER: HERE

    [4.0] - 2023-10-01

    Updated

    • Enhance explicit types sensitivity #493 (Thanks to @ vladyan18)
    • Docs on private-vars-leading-underscore rule to clarify its functionality
    • Changelog and docs for no-empty-blocks rule to clarify its functionality
    • Require package with full path #515 (Thanks to @ zouguangxian)

    Added

    • Check for updates on Solhint version to keep users up to date. There's an option to disable this check (--disc) #506
    • fix option now shows the report on screen #509
    • save option to store report on disk with the standard or the specified format #509
    • Autofix for explicit-types rule #504
    • Autofix for no-console rule #513
    • Autofix for private-vars-leading-underscore rule #511

    Fixed

  • 3.6.2 - 2023-08-17

    [3.6.2] - 2023-08-17

    Added

    • New Rule: one-contract-per-file - Enforces the use of ONE contract per file #487

    Fixed

    • foundry-test-functions - Modified regex to include invariant and statefulFuzz tests #484
    • quotes - To allow quotes inside double quotes and viceversa #485
    • JSON - Formatter returning JS object instead of standard json #490
  • 3.6.1 - 2023-08-11
  • 3.5.1 - 2023-08-04
  • 3.4.1 - 2023-03-06
  • 3.4.0 - 2023-02-17
  • 3.3.8 - 2023-01-18
  • 3.3.7 - 2022-02-10
  • 3.3.6 - 2021-05-29
  • 3.3.5 - 2021-05-21
  • 3.3.4 - 2021-03-12
  • 3.3.3 - 2021-03-04
  • 3.3.2 - 2020-11-08
  • 3.3.1 - 2020-10-27
  • 3.3.0 - 2020-10-26
  • 3.2.2 - 2020-10-15
  • 3.2.1 - 2020-09-23
  • 3.2.0 - 2020-08-13
  • 3.1.0 - 2020-07-21
  • 3.0.0 - 2020-05-04
  • 3.0.0-rc.8 - 2020-04-18
  • 3.0.0-rc.7 - 2020-04-10
  • 3.0.0-rc.6 - 2020-03-12
  • 3.0.0-rc.5 - 2020-03-03
  • 3.0.0-rc.4 - 2020-02-28
  • 3.0.0-rc.3 - 2020-02-16
  • 3.0.0-rc.2 - 2020-01-29
  • 3.0.0-rc.1 - 2020-01-24
  • 2.3.1 - 2020-03-12
  • 2.3.0 - 2019-09-25
  • 2.2.0 - 2019-08-13
  • 2.1.2 - 2019-07-18
  • 2.1.1 - 2019-07-16
  • 2.1.0 - 2019-05-30
  • 2.0.0 - 2019-02-15
  • 2.0.0-beta.2 - 2019-01-31
  • 2.0.0-beta.1 - 2019-01-31
  • 2.0.0-alpha.3 - 2019-01-23
  • 2.0.0-alpha.2 - 2019-01-07
  • 2.0.0-alpha.1 - 2019-01-07
  • 1.5.1 - 2019-01-31
from solhint GitHub release notes

Important

  • Warning: This PR contains a major version upgrade, and may be a breaking change.
  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

Snyk has created this PR to upgrade solhint from 1.5.1 to 5.0.3.

See this package in npm:
solhint

See this project in Snyk:
https://app.snyk.io/org/halagu1l/project/0e530565-0d9e-4675-95ba-721192fa5bae?utm_source=github&utm_medium=referral&page=upgrade-pr
Copy link

coderabbitai bot commented Nov 3, 2024

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.


Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

❤️ Share
🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Generate unit testing code for this file.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai generate unit testing code for this file.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and generate unit testing code.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants