From ba68ca700e7fd50a2934beed2e1fd0583715f1b0 Mon Sep 17 00:00:00 2001 From: Isbella DeMeo Date: Fri, 7 Aug 2026 13:21:07 -0400 Subject: [PATCH 1/4] feat(container): surface provenance attestations behind feature flag [PRIM-100] Bump snyk-docker-plugin to ^9.19.0 (adds provenance attestation extraction and the vcs.source fallback for buildConfigSourceUri) and gate the provenanceMetadata fact behind the surfaceProvenanceAttestations feature flag in filterDockerFacts, mirroring the allowNewContainerFacts pattern. Pinned to 9.19.0 rather than 9.20.0 deliberately. 9.20.0 adds a best-effort provenance fetch to the image's registry (snyk/snyk-docker-plugin#891). The plugin handles a failed fetch and the scan completes, but the CLI records the failed request as a command error and appends a second JSON object after the result, which breaks JSON.parse in container.spec.ts. Co-Authored-By: Claude Opus 5 (1M context) --- package-lock.json | 14 +++++++------- package.json | 2 +- src/cli/commands/constants.ts | 2 ++ src/lib/ecosystems/common.ts | 36 +++++++++++++++++++++++++++++------ 4 files changed, 40 insertions(+), 14 deletions(-) diff --git a/package-lock.json b/package-lock.json index 2fbf74d6be..56d324cc23 100644 --- a/package-lock.json +++ b/package-lock.json @@ -67,7 +67,7 @@ "semver": "^6.0.0", "snyk-config": "^5.0.0", "snyk-cpp-plugin": "^2.24.3", - "snyk-docker-plugin": "^9.16.0", + "snyk-docker-plugin": "^9.19.0", "snyk-go-plugin": "2.2.1", "snyk-gradle-plugin": "7.1.0", "snyk-module": "3.1.0", @@ -19786,9 +19786,9 @@ "license": "ISC" }, "node_modules/snyk-docker-plugin": { - "version": "9.16.0", - "resolved": "https://registry.npmjs.org/snyk-docker-plugin/-/snyk-docker-plugin-9.16.0.tgz", - "integrity": "sha512-TAmv5nHRocG0cnbvVJXOve2ss3CwDt/i0O3B4Mytx+8bhGNfkmntqkPANftMU9YQDKYkrMyJo4v40KxTqPL2cQ==", + "version": "9.19.0", + "resolved": "https://registry.npmjs.org/snyk-docker-plugin/-/snyk-docker-plugin-9.19.0.tgz", + "integrity": "sha512-XVOEneK1YKfFxOqyUR8PRBHzxosRNnfEuejNZHIKUqRdFrJjfVzxPRNo5a2ypis8z26C0/Hgha18nCwitvejRA==", "license": "Apache-2.0", "dependencies": { "@snyk/composer-lockfile-parser": "^1.4.1", @@ -19797,7 +19797,7 @@ "@snyk/rpm-parser": "^3.4.1", "@snyk/snyk-docker-pull": "^3.16.0", "@swimlane/docker-reference": "^2.0.1", - "adm-zip": "^0.5.17", + "adm-zip": "^0.5.18", "chalk": "^2.4.2", "debug": "^4.4.3", "docker-modem": "^3.0.8", @@ -19806,10 +19806,10 @@ "event-loop-spinner": "^2.3.2", "fzstd": "^0.1.1", "gunzip-maybe": "^1.4.2", - "minimatch": "^9.0.0", + "minimatch": "^9.0.9", "packageurl-js": "1.2.0", "semver": "^7.7.3", - "shescape": "^2.1.7", + "shescape": "^2.1.14", "snyk-nodejs-lockfile-parser": "^2.7.0", "snyk-poetry-lockfile-parser": "1.9.1", "snyk-resolve-deps": "^4.9.1", diff --git a/package.json b/package.json index ff726a5a1d..2b99e67aae 100644 --- a/package.json +++ b/package.json @@ -116,7 +116,7 @@ "semver": "^6.0.0", "snyk-config": "^5.0.0", "snyk-cpp-plugin": "^2.24.3", - "snyk-docker-plugin": "^9.16.0", + "snyk-docker-plugin": "^9.19.0", "snyk-go-plugin": "2.2.1", "snyk-gradle-plugin": "7.1.0", "snyk-module": "3.1.0", diff --git a/src/cli/commands/constants.ts b/src/cli/commands/constants.ts index e8b14ba04e..26643c6056 100644 --- a/src/cli/commands/constants.ts +++ b/src/cli/commands/constants.ts @@ -5,6 +5,8 @@ export const CONTAINER_CLI_APP_VULNS_ENABLED_FEATURE_FLAG = export const DISABLE_CONTAINER_MONITOR_PROJECT_NAME_FIX_FEATURE_FLAG = 'disableContainerMonitorProjectNameFix'; export const CONTAINER_NEW_FACTS_FEATURE_FLAG = 'allowNewContainerFacts'; +export const SURFACE_PROVENANCE_ATTESTATIONS_FEATURE_FLAG = + 'surfaceProvenanceAttestations'; // CLI option names export const INCLUDE_SYSTEM_JARS_OPTION = 'include-system-jars'; diff --git a/src/lib/ecosystems/common.ts b/src/lib/ecosystems/common.ts index aecc6763e8..2d83eb6c01 100644 --- a/src/lib/ecosystems/common.ts +++ b/src/lib/ecosystems/common.ts @@ -1,7 +1,14 @@ import { Ecosystem, PluginResponse, ScanResult } from './types'; import { hasFeatureFlagOrDefault } from '../feature-flags'; import { Options } from '../types'; -import { CONTAINER_NEW_FACTS_FEATURE_FLAG } from '../../cli/commands/constants'; +import { + CONTAINER_NEW_FACTS_FEATURE_FLAG, + SURFACE_PROVENANCE_ATTESTATIONS_FEATURE_FLAG, +} from '../../cli/commands/constants'; + +// Provenance attestations are gated behind their own feature flag so they can be +// rolled out independently of the broader "new container facts" flag. +const PROVENANCE_METADATA_FACT_TYPE = 'provenanceMetadata'; export function isUnmanagedEcosystem(ecosystem: Ecosystem): boolean { return ecosystem === 'cpp'; @@ -52,18 +59,35 @@ export async function filterDockerFacts( false, ); - if (includeAllFacts) { + // Provenance attestations have a dedicated flag so they can ship separately + // from the broader new-facts flag. + const includeProvenanceAttestations = await hasFeatureFlagOrDefault( + SURFACE_PROVENANCE_ATTESTATIONS_FEATURE_FLAG, + options, + false, + ); + + if (includeAllFacts && includeProvenanceAttestations) { return pluginResponse; } - // Feature disabled = filter out specific facts + // At least one flag is disabled = filter out the corresponding facts return { ...pluginResponse, scanResults: pluginResponse.scanResults.map( (scanResult: ScanResult, index: number) => ({ ...scanResult, - facts: scanResult.facts.filter( - (fact) => !shouldFilterFact(fact, index === 0), - ), + facts: scanResult.facts.filter((fact) => { + // Provenance attestations are only surfaced when their flag is on, + // independently of the new-facts flag. + if (fact.type === PROVENANCE_METADATA_FACT_TYPE) { + return includeProvenanceAttestations; + } + // When the new-facts flag is on, keep all remaining facts. + if (includeAllFacts) { + return true; + } + return !shouldFilterFact(fact, index === 0); + }), }), ), }; From 52d804077387cd2f76abbc3db40f804374a3c2ca Mon Sep 17 00:00:00 2001 From: Isabella DeMeo Date: Thu, 13 Aug 2026 10:53:34 -0400 Subject: [PATCH 2/4] refactor(container): do not gate provenance attestations behind a feature flag Provenance attestations should be surfaced unconditionally, so drop the `surfaceProvenanceAttestations` gating this PR originally introduced. `shouldFilterFact` is a denylist and `provenanceMetadata` is not in it, so removing the special case is sufficient for the fact to always pass through. The snyk-docker-plugin 9.19.0 bump is retained -- that is what produces the provenance facts. Co-Authored-By: Claude Opus 5 (1M context) --- src/cli/commands/constants.ts | 2 -- src/lib/ecosystems/common.ts | 36 ++++++----------------------------- 2 files changed, 6 insertions(+), 32 deletions(-) diff --git a/src/cli/commands/constants.ts b/src/cli/commands/constants.ts index 26643c6056..e8b14ba04e 100644 --- a/src/cli/commands/constants.ts +++ b/src/cli/commands/constants.ts @@ -5,8 +5,6 @@ export const CONTAINER_CLI_APP_VULNS_ENABLED_FEATURE_FLAG = export const DISABLE_CONTAINER_MONITOR_PROJECT_NAME_FIX_FEATURE_FLAG = 'disableContainerMonitorProjectNameFix'; export const CONTAINER_NEW_FACTS_FEATURE_FLAG = 'allowNewContainerFacts'; -export const SURFACE_PROVENANCE_ATTESTATIONS_FEATURE_FLAG = - 'surfaceProvenanceAttestations'; // CLI option names export const INCLUDE_SYSTEM_JARS_OPTION = 'include-system-jars'; diff --git a/src/lib/ecosystems/common.ts b/src/lib/ecosystems/common.ts index 2d83eb6c01..aecc6763e8 100644 --- a/src/lib/ecosystems/common.ts +++ b/src/lib/ecosystems/common.ts @@ -1,14 +1,7 @@ import { Ecosystem, PluginResponse, ScanResult } from './types'; import { hasFeatureFlagOrDefault } from '../feature-flags'; import { Options } from '../types'; -import { - CONTAINER_NEW_FACTS_FEATURE_FLAG, - SURFACE_PROVENANCE_ATTESTATIONS_FEATURE_FLAG, -} from '../../cli/commands/constants'; - -// Provenance attestations are gated behind their own feature flag so they can be -// rolled out independently of the broader "new container facts" flag. -const PROVENANCE_METADATA_FACT_TYPE = 'provenanceMetadata'; +import { CONTAINER_NEW_FACTS_FEATURE_FLAG } from '../../cli/commands/constants'; export function isUnmanagedEcosystem(ecosystem: Ecosystem): boolean { return ecosystem === 'cpp'; @@ -59,35 +52,18 @@ export async function filterDockerFacts( false, ); - // Provenance attestations have a dedicated flag so they can ship separately - // from the broader new-facts flag. - const includeProvenanceAttestations = await hasFeatureFlagOrDefault( - SURFACE_PROVENANCE_ATTESTATIONS_FEATURE_FLAG, - options, - false, - ); - - if (includeAllFacts && includeProvenanceAttestations) { + if (includeAllFacts) { return pluginResponse; } - // At least one flag is disabled = filter out the corresponding facts + // Feature disabled = filter out specific facts return { ...pluginResponse, scanResults: pluginResponse.scanResults.map( (scanResult: ScanResult, index: number) => ({ ...scanResult, - facts: scanResult.facts.filter((fact) => { - // Provenance attestations are only surfaced when their flag is on, - // independently of the new-facts flag. - if (fact.type === PROVENANCE_METADATA_FACT_TYPE) { - return includeProvenanceAttestations; - } - // When the new-facts flag is on, keep all remaining facts. - if (includeAllFacts) { - return true; - } - return !shouldFilterFact(fact, index === 0); - }), + facts: scanResult.facts.filter( + (fact) => !shouldFilterFact(fact, index === 0), + ), }), ), }; From e6545e5902e4ba92e616f44578ce2a5dd5347120 Mon Sep 17 00:00:00 2001 From: Isabella DeMeo Date: Thu, 13 Aug 2026 11:47:27 -0400 Subject: [PATCH 3/4] fix(deps): pin snyk-docker-plugin to exact 9.19.0 `^9.19.0` allows 9.20.x, which reintroduces the double-JSON-output problem described in the PR (CLIA-1576). The lockfile pinned 9.19.0 so `npm ci` was safe, but any lockfile regeneration would have silently floated to 9.20.x. Exact pinning matches the convention already used for snyk-go-plugin, snyk-gradle-plugin and snyk-module in this file. Co-Authored-By: Claude Opus 5 (1M context) --- package-lock.json | 2 +- package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package-lock.json b/package-lock.json index 56d324cc23..17713a85b2 100644 --- a/package-lock.json +++ b/package-lock.json @@ -67,7 +67,7 @@ "semver": "^6.0.0", "snyk-config": "^5.0.0", "snyk-cpp-plugin": "^2.24.3", - "snyk-docker-plugin": "^9.19.0", + "snyk-docker-plugin": "9.19.0", "snyk-go-plugin": "2.2.1", "snyk-gradle-plugin": "7.1.0", "snyk-module": "3.1.0", diff --git a/package.json b/package.json index 2b99e67aae..d7a4dbacd8 100644 --- a/package.json +++ b/package.json @@ -116,7 +116,7 @@ "semver": "^6.0.0", "snyk-config": "^5.0.0", "snyk-cpp-plugin": "^2.24.3", - "snyk-docker-plugin": "^9.19.0", + "snyk-docker-plugin": "9.19.0", "snyk-go-plugin": "2.2.1", "snyk-gradle-plugin": "7.1.0", "snyk-module": "3.1.0", From 7d33d8d3c596fc3d944af320d42adfdd9476e64d Mon Sep 17 00:00:00 2001 From: "snyk-prodsec-orb[bot]" Date: Thu, 13 Aug 2026 16:03:47 +0000 Subject: [PATCH 4/4] fix: remediate high-and-above vulnerabilities blocking the Snyk Open Source gate Applied by snyk fix --agentic via the Snyk ProdSec CircleCI orb, from PRIM-100/cli-provenance-attestations-ff-9.19.0 at e6545e5902e4ba92e616f44578ce2a5dd5347120. These changes are generated. Review them before merging. --- cliv2/go.mod | 8 ++++---- cliv2/go.sum | 20 ++++++++++---------- package-lock.json | 18 +++++++++--------- 3 files changed, 23 insertions(+), 23 deletions(-) diff --git a/cliv2/go.mod b/cliv2/go.mod index baf932d858..d0a1e000a2 100644 --- a/cliv2/go.mod +++ b/cliv2/go.mod @@ -30,7 +30,7 @@ require ( github.com/spf13/cobra v1.9.1 github.com/spf13/pflag v1.0.10 github.com/stretchr/testify v1.11.1 - golang.org/x/mod v0.36.0 + golang.org/x/mod v0.37.0 ) require ( @@ -123,7 +123,7 @@ require ( github.com/getsentry/sentry-go v0.31.1 // indirect github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect github.com/go-git/go-billy/v5 v5.9.0 // indirect - github.com/go-git/go-git/v5 v5.19.1 // indirect + github.com/go-git/go-git/v5 v5.19.2 // indirect github.com/go-ini/ini v1.67.0 // indirect github.com/go-jose/go-jose/v4 v4.1.4 // indirect github.com/go-logr/logr v1.4.3 // indirect @@ -248,12 +248,12 @@ require ( go.uber.org/multierr v1.11.0 // indirect golang.org/x/crypto v0.53.0 // indirect golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect - golang.org/x/net v0.55.0 // indirect + golang.org/x/net v0.56.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.21.0 // indirect golang.org/x/sys v0.46.0 // indirect golang.org/x/term v0.44.0 // indirect - golang.org/x/text v0.38.0 // indirect + golang.org/x/text v0.39.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/api v0.271.0 // indirect google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect diff --git a/cliv2/go.sum b/cliv2/go.sum index 77ea92209d..bdfb76c99e 100644 --- a/cliv2/go.sum +++ b/cliv2/go.sum @@ -253,8 +253,8 @@ github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmm github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= -github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00= -github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ= +github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY= +github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk= github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A= github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= @@ -690,8 +690,8 @@ golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJk golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80= golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= -golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4= -golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ= +golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= +golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= @@ -701,8 +701,8 @@ golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qx golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= -golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= -golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww= +golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= +golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -750,16 +750,16 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= -golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE= -golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4= +golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus= +golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= -golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8= -golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0= +golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= +golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= diff --git a/package-lock.json b/package-lock.json index 17713a85b2..3ec9f24b9b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3150,9 +3150,9 @@ "license": "Python-2.0" }, "node_modules/@snyk/cocoapods-lockfile-parser/node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github", @@ -15117,9 +15117,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "3.15.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", - "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", + "version": "3.15.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz", + "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==", "license": "MIT", "dependencies": { "argparse": "^1.0.7", @@ -20192,9 +20192,9 @@ } }, "node_modules/snyk-nodejs-lockfile-parser/node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github",