Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Chore: fixes some npm audit vulnerabilities - autoclosed #48

Closed
wants to merge 1 commit into from

Conversation

lalaps[bot]
Copy link
Contributor

@lalaps lalaps bot commented Feb 12, 2022

This PR fixes some of found vulnerabilities.

Fixed 4 of 12 npm vulnerabilities.
8 issues left.
Success Rate: 33.3%

Vulnerabilities:

Inefficient Regular Expression Complexity in chalk/ansi-regex
Library: ansi-regex
Affected versions: >=3.0.0 <3.0.1
Severity: high
Fix: ✔️ true
Root Libraries:

Template injection in ejs
Library: ejs
Affected versions: <3.1.7
Severity: critical
Fix: ❌ 3.11.1
Root Libraries:

  • ejs <3.1.7. Fixed in 3.11.1

Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects
Library: follow-redirects
Affected versions: <1.14.8
Severity: moderate
Fix: ✔️ true
Root Libraries:

Prototype Pollution in minimist
Library: minimist
Affected versions: <1.2.6
Severity: critical
Fix: ✔️ true
Root Libraries:

Path Traversal: 'dir/../../filename' in moment.locale
Library: moment
Affected versions: <2.29.2
Severity: high
Fix: ✔️ true
Root Libraries:

Packing does not respect root-level ignore files in workspaces
Library: npm
Affected versions: >=7.9.0 <8.11.0
Severity: high
Fix: ✔️ true
Root Libraries:

Authorization Bypass in parse-path
Library: parse-path
Affected versions: <5.0.0
Severity: high
Fix: ❌ true
Root Libraries:

Cross site scripting in parse-url
Library: parse-url
Affected versions: <6.0.1
Severity: moderate
Fix: ✔️ true
Root Libraries:

Exposure of Sensitive Information to an Unauthorized Actor in semantic-release
Library: semantic-release
Affected versions: >=17.0.4 <19.0.3
Severity: moderate
Fix: ✔️ true
Root Libraries:

  • ✔️ semantic-release 17.0.4 - 19.0.2. Fixed in true

Regular expression denial of service in semver-regex
Library: semver-regex
Affected versions: <3.1.4
Severity: low
Fix: ✔️ true
Root Libraries:

Command injection in simple-git
Library: simple-git
Affected versions: <3.3.0
Severity: high
Fix: ❌ 3.10.0
Root Libraries:

  • simple-git <=3.4.0. Fixed in 3.10.0

You can wait for the next updates with a full fix or merge immediately.
In case of closing this PR, it will be recreated. If that's undesired, modify config.


This change is Reviewable

No fix can further be provided.

@pustovitDmytro
Copy link
Owner

pustovitDmytro commented Feb 12, 2022

Warnings
⚠️

Only owner can change system files [package-lock.json], please provide issue instead

Messages
📖

lalaps[bot] login already contributed 5 times

📖 Changed Files in this PR:
  • package-lock.json

Generated by 🚫 dangerJS against 867f2c1

@lalaps lalaps bot force-pushed the lalaps/npm-partial-fix branch 7 times, most recently from 34ed3fd to 867f2c1 Compare March 12, 2022 01:04
@lalaps lalaps bot force-pushed the lalaps/npm-partial-fix branch 5 times, most recently from dfc2dad to 59a8e85 Compare March 24, 2022 01:09
@lalaps lalaps bot force-pushed the lalaps/npm-partial-fix branch 4 times, most recently from 6bf9e54 to 6536a57 Compare March 30, 2022 00:05
@lalaps lalaps bot force-pushed the lalaps/npm-partial-fix branch 5 times, most recently from f3e049d to 294a0d7 Compare April 11, 2022 00:05
@lalaps lalaps bot force-pushed the lalaps/npm-partial-fix branch from 294a0d7 to 4d7c7fb Compare April 13, 2022 00:06
@lalaps lalaps bot force-pushed the lalaps/npm-partial-fix branch 7 times, most recently from 444b938 to 6cdeae5 Compare April 29, 2022 00:08
@lalaps lalaps bot force-pushed the lalaps/npm-partial-fix branch 2 times, most recently from 8d4f7d1 to a501511 Compare May 4, 2022 00:07
@lalaps lalaps bot force-pushed the lalaps/npm-partial-fix branch 2 times, most recently from 4a30192 to ef63f21 Compare June 2, 2022 00:12
@lalaps lalaps bot force-pushed the lalaps/npm-partial-fix branch 2 times, most recently from 548fbf4 to 7ffa025 Compare June 4, 2022 00:07
@lalaps lalaps bot force-pushed the lalaps/npm-partial-fix branch 3 times, most recently from cd107a8 to 9e671a2 Compare June 16, 2022 00:08
@lalaps lalaps bot force-pushed the lalaps/npm-partial-fix branch 3 times, most recently from aa8feb2 to af609d6 Compare June 23, 2022 00:06
@lalaps lalaps bot force-pushed the lalaps/npm-partial-fix branch 2 times, most recently from b3ec32f to 134cbbd Compare June 30, 2022 00:09
@lalaps lalaps bot force-pushed the lalaps/npm-partial-fix branch 3 times, most recently from 2ce6754 to 1897118 Compare July 9, 2022 00:09
@lalaps lalaps bot force-pushed the lalaps/npm-partial-fix branch from 1897118 to 8f68a5e Compare July 12, 2022 00:11
@sonarcloud
Copy link

sonarcloud bot commented Jul 12, 2022

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

@lalaps lalaps bot changed the title Chore: fixes some npm audit vulnerabilities Chore: fixes some npm audit vulnerabilities - autoclosed Jul 19, 2022
@lalaps lalaps bot closed this Jul 19, 2022
@lalaps lalaps bot deleted the lalaps/npm-partial-fix branch July 19, 2022 00:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant