Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Chore: fixes some npm audit vulnerabilities #92

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

lalaps[bot]
Copy link
Contributor

@lalaps lalaps bot commented Nov 29, 2022

This PR fixes some of found vulnerabilities.

Fixed 7 of 11 npm vulnerabilities.
4 issues left.
Success Rate: 63.6%

Vulnerabilities:

decode-uri-component vulnerable to Denial of Service (DoS)
Library: decode-uri-component
Affected versions: <=0.2.0
Severity: low
Fix: ❌ 11.2.0
Root Libraries:

  • danger 8.0.0-alpha-1 - 11.1.3. Fixed in 11.2.0
  • ✔️ semantic-release-telegram 1.1.0 - 1.5.2. Fixed in true

minimatch ReDoS vulnerability
Library: minimatch
Affected versions: <3.0.5
Severity: high
Fix: ✔️ true
Root Libraries:

  • ✔️ mocha 5.1.0 - 9.2.1. Fixed in true

Authorization Bypass in parse-path
Library: parse-path
Affected versions: <5.0.0
Severity: high
Fix: ✔️ true
Root Libraries:

  • ✔️ semantic-release-telegram 1.1.0 - 1.5.2. Fixed in true

parse-url parses http URLs incorrectly, making it vulnerable to host name spoofing
Library: parse-url
Affected versions: <8.1.0
Severity: moderate
Fix: ✔️ true
Root Libraries:

  • ✔️ semantic-release-telegram 1.1.0 - 1.5.2. Fixed in true

You can wait for the next updates with a full fix or merge immediately.
In case of closing this PR, it will be recreated. If that's undesired, modify config.


This change is Reviewable

@lalaps lalaps bot added the dependencies label Nov 29, 2022
@lalaps lalaps bot added the security label Nov 29, 2022
@lalaps lalaps bot mentioned this pull request Nov 29, 2022
@sonarcloud
Copy link

sonarcloud bot commented Nov 29, 2022

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

@pustovitDmytro
Copy link
Owner

Warnings
⚠️

Only owner can change system files [package-lock.json], please provide issue instead

Messages
📖

lalaps[bot] login already contributed 3 times

📖 Changed Files in this PR:
  • package-lock.json

Generated by 🚫 dangerJS against 866ee94

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant