Skip to content

/ brave-browser

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

npm vulnerability: `minimist` #8722

Closed
bsclifton opened this issue Mar 17, 2020 · 6 comments
Closed

npm vulnerability: `minimist` #8722

bsclifton opened this issue Mar 17, 2020 · 6 comments
Assignees
@cezaraugusto @bsclifton
Labels
QA/No dev-concern release-notes/exclude

Comments

@bsclifton
Copy link
Member

@bsclifton bsclifton commented Mar 17, 2020

Description

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ jest [dev]                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ jest > @jest/core > jest-runner > jest-jasmine2 >            │
│               │ jest-runtime > @jest/transform > jest-haste-map > sane >     │
│               │ @cnakazawa/watch > minimist                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

Steps to Reproduce

  1. Have full setup of Brave
  2. run npm run audit_deps from root
  3. have a bad time
@bsclifton bsclifton added this to the 1.8.x - Nightly milestone Mar 17, 2020
This was referenced Mar 17, 2020
Merged
Merged
@bsclifton bsclifton closed this in 4fccad7 Mar 17, 2020
@bsclifton bsclifton mentioned this issue Mar 17, 2020
Merged
6 of 29 tasks complete
@bsclifton bsclifton reopened this Mar 17, 2020
This was referenced Mar 18, 2020
Merged
Merged
Merged
Merged
Merged
bsclifton added a commit to brave/brave-core that referenced this issue Mar 18, 2020
@bsclifton
Fix npm package vulnerabilities
Loading status checks…
0ac4484 
Helps fix brave/brave-browser#8722

- Rebuild `package-lock.json` after deleting and running `npm i`
- use `optional-dev-dependency` to avoid dev dependency introduced vulnerabilities
- update parse-domain to use a fork (brave/parse-domain) which has fixed  dependencies
@bsclifton bsclifton mentioned this issue Mar 18, 2020
Closed
8 of 32 tasks complete
bsclifton added a commit to brave/brave-core that referenced this issue Mar 18, 2020
@bsclifton
Introduce `npm-force-resolutions` dependency to help resolve npm audi…
Loading status checks…
7bf2fdc 
…t vulnerabilities

Helps to fix brave/brave-browser#8722
bsclifton added a commit to brave/sync that referenced this issue Mar 18, 2020
@bsclifton
Introduce `npm-force-resolutions` dependency to help resolve npm audi…
Loading status checks…
13e6b9c 
…t vulnerabilities

Helps to fix brave/brave-browser#8722
bsclifton added a commit to brave/sync that referenced this issue Mar 18, 2020
@bsclifton
Introduce `npm-force-resolutions` dependency to help resolve npm audi…
Loading status checks…
372fe7d 
…t vulnerabilities

Helps to fix brave/brave-browser#8722
This was referenced Mar 18, 2020
Merged
Merged
bsclifton added a commit that referenced this issue Mar 18, 2020
@bsclifton
Introduce `npm-force-resolutions` dependency to help resolve npm audi…
Loading status checks…
54cb764 
…t vulnerabilities

Helps to fix #8722
@bsclifton bsclifton mentioned this issue Mar 18, 2020
Closed
2 of 29 tasks complete
@bsclifton bsclifton self-assigned this Mar 18, 2020
ryanml added a commit to brave/brave-core that referenced this issue Mar 18, 2020
@ryanml
Adds npm-force-resolutions dependency
6a0ddbf 
Partially resolves brave/brave-browser#8722
bsclifton added a commit to brave/brave-core that referenced this issue Mar 18, 2020
@bsclifton
Introduce `npm-force-resolutions` dependency to help resolve npm audi…
Loading status checks…
e0424d6 
…t vulnerabilities

Helps to fix brave/brave-browser#8722
bsclifton added a commit that referenced this issue Mar 18, 2020
@bsclifton
Introduce `npm-force-resolutions` dependency to help resolve npm audi…
Loading status checks…
492815e 
…t vulnerabilities

Helps to fix #8722
bsclifton added a commit to brave/sync that referenced this issue Mar 18, 2020
@bsclifton
Introduce `npm-force-resolutions` dependency to help resolve npm audi…
Loading status checks…
fac6066 
…t vulnerabilities

Helps to fix brave/brave-browser#8722
bsclifton added a commit to brave/sync that referenced this issue Mar 18, 2020
@bsclifton
Introduce `npm-force-resolutions` dependency to help resolve npm audi…
Loading status checks…
fb336a7 
…t vulnerabilities

Helps to fix brave/brave-browser#8722
This was referenced Mar 24, 2020
Merged
Merged
Merged
Merged
bsclifton added a commit that referenced this issue Mar 24, 2020
@bsclifton
Rebuild package-lock.json to fix npm audit errors
Loading status checks…
938e733 
Fixes #8722
@bsclifton
Copy link
Member Author

@bsclifton bsclifton commented Mar 24, 2020

Should be completely resolved with brave/brave-core#5013 and #8788
This was referenced Mar 26, 2020
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
bsclifton added a commit to brave/brave-core that referenced this issue Mar 31, 2020
@bsclifton
Update npm deps for 1.7
78398b7 
Fixes brave/brave-browser#8722 for 1.7
bsclifton added a commit that referenced this issue Mar 31, 2020
@bsclifton
Update npm deps for 1.7
Loading status checks…
de15d61 
Fixes #8722 for 1.7 (`brave-browser`)
bsclifton added a commit to brave/brave-core that referenced this issue Mar 31, 2020
@bsclifton
Update npm deps for 1.7
Loading status checks…
ea2de73 
Fixes brave/brave-browser#8722 for 1.7 (`brave-core`)
This was referenced Mar 31, 2020
Closed
Closed
This was referenced Mar 31, 2020
Merged
Merged
Merged
Merged
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@cezaraugusto cezaraugusto

@bsclifton bsclifton

Labels
QA/No dev-concern release-notes/exclude
Projects
None yet
Milestone
No milestone
Linked pull requests

Successfully merging a pull request may close this issue.

Resolve npm vulnerabilities (part 1 of 3)
Introduce `npm-force-resolutions` dependency to help resolve npm audit vulnerabilities
Rebuild package-lock.json to fix npm audit errors
Rebuild package-lock.json to fix npm audit errors
WIP: Resolve npm vulnerabilities (part 3 of 3)
Introduce `npm-force-resolutions` dependency to help resolve npm audit vulnerabilities
WIP: Rebuild package-lock.json to fix npm audit errors
update2019.12.27 (#1)
Fix npm audit vulnerabilities for 1.7.x
Fix npm audit vulnerabilities for 1.7.x
4 participants
@kjozwiak @cezaraugusto @bsclifton @ryanml
You can’t perform that action at this time.