Skip to content

Conversation

@jit-ci
Copy link

@jit-ci jit-ci bot commented Oct 24, 2023

No description provided.

Copy link
Author

@jit-ci jit-ci bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❌ Jit has detected 1 important finding in this PR that you should review.
The finding is detailed below as a comment.
It’s highly recommended that you fix this security issue before merge.

"author": "",
"license": "ISC",
"dependencies": {
"pac-resolver": "4.2.0"
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security control: Software Component Analysis Js

Type: Code Injection In Pac-Resolver

Description: Paths from library to vulnerable dependencies:

  • pac-resolver
  • pac-resolver>degenerator

Is fix available? Yes, pac-resolver@7.0.0

Severity: HIGH

Learn more about this issue


Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

Update each outdated library in your code.

Note: Once you apply these changes, you'll need to regenerate the package-lock.json file on your end.

Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.

Suggested change
"pac-resolver": "4.2.0"
"pac-resolver": "7.0.0"

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

  • #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”
  • #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”
  • #jit_undo_ignore Undo ignore command

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants