Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Is this project still beign mantained? #484

Open
orimeli opened this issue Jan 5, 2022 · 0 comments
Open

Is this project still beign mantained? #484

orimeli opened this issue Jan 5, 2022 · 0 comments

Comments

@orimeli
Copy link

orimeli commented Jan 5, 2022

Problem Description

Hi! This is not a big problem, just a question: Is this project being mantained?

I'm having some dependency issues with the last published version (0.21.2), in particular:

{
        "dependency": "pkg:npm/sass-lint-auto-fix@0.21.2",
        "issues": [
            {
                "action": {
                    "upgrade_to": ""
                },
                "origin": {
                    "purl": "pkg:npm/ajv@4.11.8",
                    "version_range": "<6.12.3"
                },
                "reason": "Prototype Pollution",
                "severity": "high"
            },
            {
                "action": {
                    "upgrade_to": ""
                },
                "origin": {
                    "purl": "pkg:npm/merge@1.2.1",
                    "version_range": "<2.1.0"
                },
                "reason": "Prototype Pollution",
                "severity": "high"
            },
            {
                "action": {
                    "upgrade_to": ""
                },
                "origin": {
                    "purl": "pkg:npm/merge@1.2.1",
                    "version_range": "<2.1.1"
                },
                "reason": "Prototype Pollution",
                "severity": "high"
            },
            {
                "action": {
                    "upgrade_to": ""
                },
                "origin": {
                    "purl": "pkg:npm/minimist@1.1.3",
                    "version_range": "<0.2.1,>=1.0.0 <1.2.3"
                },
                "reason": "Prototype Pollution",
                "severity": "medium"
            },
            {
                "action": {
                    "upgrade_to": ""
                },
                "origin": {
                    "purl": "pkg:npm/eslint@2.13.1",
                    "version_range": ">=1.4.0 <4.18.2"
                },
                "reason": "Regular Expression Denial of Service (ReDoS)",
                "severity": "low"
            },
            {
                "action": {
                    "upgrade_to": ""
                },
                "origin": {
                    "purl": "pkg:npm/front-matter@2.1.2",
                    "version_range": "<4.0.1"
                },
                "reason": "Arbitrary Code Execution",
                "severity": "critical"
            },
            {
                "action": {
                    "upgrade_to": ""
                },
                "origin": {
                    "purl": "pkg:npm/ansi-regex@3.0.0",
                    "version_range": ">=6.0.0 <6.0.1,>2.1.1 <5.0.1"
                },
                "reason": "Regular Expression Denial of Service (ReDoS)",
                "severity": "high"
            }
        ]
    }

It is possible to upgrade this dependencies, to prevent this security vulnerabilities?

node version: v14.17.0
npm version: 6.14.13

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant