[Snyk] Upgrade @tensorflow/tfjs-node from 3.14.0 to 4.11.0 #443

aravindvnair99 · 2023-10-06T05:21:56Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade @tensorflow/tfjs-node from 3.14.0 to 4.11.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Warning: This is a major version upgrade, and may be a breaking change.

The recommended version is 20 versions ahead of your current version.
The recommended version was released 23 days ago, on 2023-09-13.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Internal Property Tampering SNYK-JS-TAFFYDB-2992450	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Improper Authentication SNYK-JS-JSONWEBTOKEN-3180022	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Improper Restriction of Security Token Assignment SNYK-JS-JSONWEBTOKEN-3180024	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Use of a Broken or Risky Cryptographic Algorithm SNYK-JS-JSONWEBTOKEN-3180026	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Prototype Pollution SNYK-JS-MINIMIST-2429795	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-WORDWRAP-3149973	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: @tensorflow/tfjs-node

4.11.0 - 2023-09-13
Core (4.10.0 ==> 4.11.0)

Bug fixes
- Make MultiHeadAttention use masks from query and value tensors (#7951).
- [tfjs-core] fix gather gradient when batchDims is 1 (#7942). Thanks, @ paradite.
Misc
- Update lockfiles branch tfjs_4.11.0_lockfiles lock files. (#7958). Thanks, @ Dedongala.
- Update monorepo to 4.11.0. (#7957). Thanks, @ Dedongala.
- Re-enable nightly firefox tests (#7954).
- [WebGPU] Ensure tf.any and tf.all return bool tensors (#7928).
- [tfjs-node] fixed range issue for int32 tensor with size larger than 2 ^ 24 (#7931).
- Disable firefox browserstack tests temporarily (#7935).
Data (4.10.0 ==> 4.11.0)

Misc
- Update monorepo to 4.11.0. (#7957). Thanks, @ Dedongala.
- Disable firefox browserstack tests temporarily (#7935).
Layers (4.10.0 ==> 4.11.0)

Bug fixes
- Make MultiHeadAttention use masks from query and value tensors (#7951).
Misc
- Update monorepo to 4.11.0. (#7957). Thanks, @ Dedongala.
- Re-enable nightly firefox tests (#7954).
- Add spec for GPT2CausalLM and dependencies (#7897). Thanks, @ pforderique.
- Disable firefox browserstack tests temporarily (#7935).
- Fix bug where a model with empty weights fails to load (#7868). Thanks, @ thekevinscott.
- Implement GPT2 Backbone (#7894). Thanks, @ pforderique.
- Implement TransformerDecoder layer (#7890). Thanks, @ pforderique.
- Implement CachedMultiHeadAttention layer (#7882). Thanks, @ pforderique.
- Implement PositionEmbedding layer (#7887). Thanks, @ pforderique.
- Implement MultiHeadAttention Layer (#7875). Thanks, @ pforderique.
- Update weights loading (#7872).
Converter (4.10.0 ==> 4.11.0)

Misc
- Update lockfiles branch tfjs_4.11.0_lockfiles lock files. (#7958). Thanks, @ Dedongala.
- Update monorepo to 4.11.0. (#7957). Thanks, @ Dedongala.
- Update Hyperlinks To Correct Hyperlinks (#7891). Thanks, @ gaikwadrahul8.
- Update README.md for tf-nightly-cpu-2.0-preview hyperlink (#7879). Thanks, @ gaikwadrahul8.
- fix converter tests (#7901).
- [e2e] fix tf1 hashtable test (#7904).
- Load python rules in tfjs-converter converters dir (#7892).
- Strip debug ops in jax conversion tests (#7889).
Node (4.10.0 ==> 4.11.0)

Misc
- Update lockfiles branch tfjs_4.11.0_lockfiles lock files. (#7958). Thanks, @ Dedongala.
- Update monorepo to 4.11.0. (#7957). Thanks, @ Dedongala.
- [tfjs-node] fixed range issue for int32 tensor with size larger than 2 ^ 24 (#7931).
Wasm (4.10.0 ==> 4.11.0)

Bug fixes
- fix wasm backend memory leak issue. (#7915). Thanks, @ LiujhDev.
Misc
- Update lockfiles branch tfjs_4.11.0_lockfiles lock files. (#7958). Thanks, @ Dedongala.
- Update monorepo to 4.11.0. (#7957). Thanks, @ Dedongala.
- Re-enable nightly firefox tests (#7954).
- Disable firefox browserstack tests temporarily (#7935).
Cpu (4.10.0 ==> 4.11.0)

Misc
- Update monorepo to 4.11.0. (#7957). Thanks, @ Dedongala.
Webgl (4.10.0 ==> 4.11.0)

Features
- add flag (#7934).
Misc
- Update lockfiles branch tfjs_4.11.0_lockfiles lock files. (#7958). Thanks, @ Dedongala.
- Update monorepo to 4.11.0. (#7957). Thanks, @ Dedongala.
- Re-enable nightly firefox tests (#7954).
- Disable firefox browserstack tests temporarily (#7935).
WebGPU (4.10.0 ==> 4.11.0)

Bug fixes
- [webgpu] Fix cast error (#7899). Thanks, @ qjia7.
Misc
- Update lockfiles branch tfjs_4.11.0_lockfiles lock files. (#7958). Thanks, @ Dedongala.
- Update monorepo to 4.11.0. (#7957). Thanks, @ Dedongala.
- [webgpu] Don't try to check instanceof a specific promise type (#7944).
- [WebGPU] Ensure tf.any and tf.all return bool tensors (#7928).
- Disable firefox browserstack tests temporarily (#7935).
4.10.0 - 2023-08-01
Read more
4.9.0 - 2023-07-18
Read more
4.8.0 - 2023-06-20
Read more
4.7.0 - 2023-06-06
Read more
4.6.0 - 2023-05-17
Core (4.5.0 ==> 4.6.0)

Features
- Add Draw API (#7628).
Misc
- Update tfjs_4.6.0_lockfiles (#7698).
- Update monorepo to 4.6.0. (#7693).
- Support loading models with weights above 2GB on Chrome (#7609).
Data (4.5.0 ==> 4.6.0)

Misc
- Update monorepo to 4.6.0. (#7693).
Layers (4.5.0 ==> 4.6.0)

Misc
- Update monorepo to 4.6.0. (#7693).
- Support loading models with weights above 2GB on Chrome (#7609).
Converter (4.5.0 ==> 4.6.0)

Misc
- Update tfjs_4.6.0_lockfiles (#7698).
- Update monorepo to 4.6.0. (#7693).
- Support loading models with weights above 2GB on Chrome (#7609).
Node (4.5.0 ==> 4.6.0)

Misc
- Update tfjs_4.6.0_lockfiles (#7698).
- Update monorepo to 4.6.0. (#7693).
- Support loading models with weights above 2GB on Chrome (#7609).
Wasm (4.5.0 ==> 4.6.0)

Features
- [wasm] Add Mod kernel (#7670).
Misc
- Update tfjs_4.6.0_lockfiles (#7698).
- Update monorepo to 4.6.0. (#7693).
- [wasm] Add MaxPoolWithArgmax kernel (#7673).
- [wasm] Add AvgPoolGrad and MaxPoolGrad kernel (#7672).
- [wasm] Add Erf kernel (#7669).
- [wasm] Add Sinh kernel (#7671).
- add wasm backend for bitwiseAnd API (#7661).
Cpu (4.5.0 ==> 4.6.0)

Features
- Add Draw API (#7628).
Misc
- Update monorepo to 4.6.0. (#7693).
Webgl (4.5.0 ==> 4.6.0)

Features
- Add Draw API (#7628).
Misc
- Update tfjs_4.6.0_lockfiles (#7698).
- Update monorepo to 4.6.0. (#7693).
- Webgl backend for bitwise AND API (#7654).(base)
4.5.0 - 2023-05-05
Read more
4.4.0 - 2023-04-06
Read more
4.3.0 - 2023-03-17
Read more
4.2.0 - 2023-01-03
4.1.0 - 2022-11-20
4.0.0 - 2022-10-13
3.21.1 - 2022-10-06
3.21.0 - 2022-10-06
3.20.0 - 2022-08-23
3.19.0 - 2022-07-22
3.18.0 - 2022-05-21
3.17.0 - 2022-05-12
3.16.0 - 2022-04-19
3.15.0 - 2022-03-22
3.14.0 - 2022-03-03

from @tensorflow/tfjs-node GitHub release notes

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade @tensorflow/tfjs-node from 3.14.0 to 4.11.0. See this package in npm: https://www.npmjs.com/package/@tensorflow/tfjs-node See this project in Snyk: https://app.snyk.io/org/aravindvnair99-github-marketplace/project/3e229b24-b2de-4c21-9d58-eebf425f44fc?utm_source=github&utm_medium=referral&page=upgrade-pr

guardrails · 2023-10-06T05:22:23Z

⚠️ We detected 8 security issues in this pull request:

Insecure File Management (1)

Severity

Details

Docs

High

Title: Path Traversal from user input

Spot-the-Hole/functions/index.js

Line 562 in 1955901

path.join(os.tmpdir(), path.basename(req.files.file[0].fieldname)),

📚

More info on how to fix Insecure File Management in JavaScript.

Insecure Use of Crypto (1)

Severity

Details

Docs

Medium

Title: Insecure use of random generator

Spot-the-Hole/functions/index.js

Line 204 in 1955901

result += characters.charAt(Math.floor(Math.random() * charactersLength));

📚

More info on how to fix Insecure Use of Crypto in JavaScript.

Vulnerable Libraries (6)

Severity	Details
Critical	pkg:npm/[email protected]@1.2.5 (t) upgrade to: 1.2.6
Informational	pkg:npm/[email protected]@10.8.5 (t) - no patch available
High	pkg:npm/[email protected] (t) - no patch available
Critical	pkg:npm/@tensorflow/[email protected]@1.2.5 (t) upgrade to: 1.2.6
Informational	pkg:npm/[email protected]@2.6.9 (t) upgrade to: 3.1.0
Medium	pkg:npm/@tensorflow/[email protected]@2.6.7 (t) - no patch available

More info on how to fix Vulnerable Libraries in JavaScript.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

sonarqubecloud · 2023-10-06T05:22:29Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

stale · 2023-10-20T05:48:39Z

Automatically marked as stale due to lack of recent activity. Will be closed if no further activity occurs. Thank you for your contributions.

stale · 2023-10-28T11:05:24Z

Automatically closed due to lack of recent activity. Tag @aravindvnair99 to reopen. Thank you for your contributions.

pull-request-size bot added the size/XS label Oct 6, 2023

stale bot added the stale label Oct 20, 2023

stale bot closed this Oct 28, 2023

[Snyk] Upgrade @tensorflow/tfjs-node from 3.14.0 to 4.11.0 #443

[Snyk] Upgrade @tensorflow/tfjs-node from 3.14.0 to 4.11.0 #443

Conversation

aravindvnair99 commented Oct 6, 2023

Snyk has created this PR to upgrade @tensorflow/tfjs-node from 3.14.0 to 4.11.0.

Core (4.10.0 ==> 4.11.0)

Bug fixes

Misc

Data (4.10.0 ==> 4.11.0)

Misc

Layers (4.10.0 ==> 4.11.0)

Bug fixes

Misc

Converter (4.10.0 ==> 4.11.0)

Misc

Node (4.10.0 ==> 4.11.0)

Misc

Wasm (4.10.0 ==> 4.11.0)

Bug fixes

Misc

Cpu (4.10.0 ==> 4.11.0)

Misc

Webgl (4.10.0 ==> 4.11.0)

Features

Misc

WebGPU (4.10.0 ==> 4.11.0)

Bug fixes

Misc

Core (4.5.0 ==> 4.6.0)

Features

Misc

Data (4.5.0 ==> 4.6.0)

Misc

Layers (4.5.0 ==> 4.6.0)

Misc

Converter (4.5.0 ==> 4.6.0)

Misc

Node (4.5.0 ==> 4.6.0)

Misc

Wasm (4.5.0 ==> 4.6.0)

Features

Misc

Cpu (4.5.0 ==> 4.6.0)

Features

Misc

Webgl (4.5.0 ==> 4.6.0)

Features

Misc

guardrails bot commented Oct 6, 2023

sonarqubecloud bot commented Oct 6, 2023

stale bot commented Oct 20, 2023

stale bot commented Oct 28, 2023