Some dependencies have a dependency on minimist that is not executed, but would be nice to update.

[mjziolko]

Bug report

Describe the bug

Multiple security vulnerabilities associated with next dependencies.

Ex:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=1.2.3                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ next                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ next > mkdirp > minimist                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

Next needs to update four packages to patch this vulnerability:

next > babel-loader > mkdirp > minimist
next > cache-loader > mkdirp > minimist
next > mkdirp > minimist
next > webpack > mkdirp > minimist

There are even more associated with webpack and its dependencies.

To Reproduce

• Install nextjs in a project
• npm audit
• npm reports 10 moderate security vulnerabilities associated with next

Expected behavior

npm reports no security vulnerabilities associated with next

Screenshots

If applicable, add screenshots to help explain your problem.

System information

• OS: macOS
• Browser: N/A
• Version of Next.js: 9.3.1

[timneutkens]

Just to be clear. Next.js does not execute minimist from any of these packages. So there is no attack vector for any of these when using Next.js.

[timneutkens]

Updated the title to correctly reflect what is actually the case.

[Timer]

Closing as I don't see this anymore

[balazsorban44]

This issue has been automatically locked due to no recent activity. If you are running into a similar issue, please create a new issue with the steps to reproduce. Thank you.