Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Please update dependencies to address npm audit warnings #26

Open
stennie opened this issue Nov 2, 2018 · 4 comments
Open

Please update dependencies to address npm audit warnings #26

stennie opened this issue Nov 2, 2018 · 4 comments

Comments

@stennie
Copy link

stennie commented Nov 2, 2018

                   === npm audit security report ===

Run npm install --save-dev [email protected] to resolve 2 vulnerabilities

SEMVER WARNING: Recommended action is a potentially breaking change

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ ms                                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ mocha [dev]                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ mocha > ms                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/46                        │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Critical      │ Command Injection                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ growl                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ mocha [dev]                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ mocha > growl                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/146                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

Run npm install [email protected] to resolve 2 vulnerabilities

SEMVER WARNING: Recommended action is a potentially breaking change

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Large gzip Denial of Service                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ superagent                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ superagent                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ superagent                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/479                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ mime                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ superagent                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ superagent > mime                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/535                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

Run npm install [email protected] to resolve 1 vulnerability

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/577                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

found 5 vulnerabilities (2 low, 2 moderate, 1 critical) in 46 scanned packages
run npm audit fix to fix 1 of them.
4 vulnerabilities require semver-major dependency updates.

@quaelin
Copy link

quaelin commented Feb 14, 2019

+1

@autoboxer
Copy link

I'd like to see this as well, it would help resolve vulnerabilities in Keystone.js.

@autoboxer
Copy link

@dokipen, I created a pull request with the needed updates.

@quaelin
Copy link

quaelin commented Aug 26, 2021

@dokipen @TooTallNate @screeley @floating would anyone be up for publishing a new release with updated dependencies?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants