Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Chore: fixes some npm audit vulnerabilities #60

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

lalaps[bot]
Copy link
Contributor

@lalaps lalaps bot commented Mar 22, 2022

This PR fixes some of found vulnerabilities.

Fixed 2 of 14 npm vulnerabilities.
12 issues left.
Success Rate: 14.3%

Vulnerabilities:

Inefficient Regular Expression Complexity in chalk/ansi-regex
Library: ansi-regex
Affected versions: >=3.0.0 <3.0.1
Severity: high
Fix: ✔️ true
Root Libraries:

decode-uri-component vulnerable to Denial of Service (DoS)
Library: decode-uri-component
Affected versions: <=0.2.0
Severity: low
Fix: ❌ 11.2.0
Root Libraries:

  • danger 8.0.0-alpha-1 - 11.1.3. Fixed in 11.2.0

Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects
Library: follow-redirects
Affected versions: <1.14.8
Severity: moderate
Fix: ✔️ true
Root Libraries:

minimatch ReDoS vulnerability
Library: minimatch
Affected versions: <3.0.5
Severity: high
Fix: ❌ true
Root Libraries:

  • ✔️ mocha 5.1.0 - 9.2.1. Fixed in true

Prototype Pollution in minimist
Library: minimist
Affected versions: <1.2.6
Severity: critical
Fix: ✔️ true
Root Libraries:

Packing does not respect root-level ignore files in workspaces
Library: npm
Affected versions: >=7.9.0 <8.11.0
Severity: high
Fix: ✔️ true
Root Libraries:

Authorization Bypass in parse-path
Library: parse-path
Affected versions: <5.0.0
Severity: high
Fix: ❌ true
Root Libraries:

Cross site scripting in parse-url
Library: parse-url
Affected versions: <6.0.1
Severity: moderate
Fix: ✔️ true
Root Libraries:

Exposure of Sensitive Information to an Unauthorized Actor in semantic-release
Library: semantic-release
Affected versions: >=17.0.4 <19.0.3
Severity: moderate
Fix: ✔️ true
Root Libraries:

  • ✔️ semantic-release 17.0.4 - 19.0.2. Fixed in true

Regular expression denial of service in semver-regex
Library: semver-regex
Affected versions: <3.1.4
Severity: low
Fix: ✔️ true
Root Libraries:

You can wait for the next updates with a full fix or merge immediately.
In case of closing this PR, it will be recreated. If that's undesired, modify config.


This change is Reviewable

@lalaps lalaps bot requested a review from pustovitDmytro as a code owner March 22, 2022 17:05
@lalaps lalaps bot mentioned this pull request Mar 22, 2022
@lalaps lalaps bot force-pushed the lalaps/npm-force-partial-fix branch from 74ca987 to 9a80a3a Compare March 24, 2022 01:08
@pustovitDmytro
Copy link
Owner

pustovitDmytro commented Mar 24, 2022

Warnings
⚠️

Only owner can change system files [package-lock.json, package.json], please provide issue instead

Messages
📖 Changed Files in this PR:
  • package-lock.json

  • package.json

📖

lalaps[bot] login already contributed 4 times

Generated by 🚫 dangerJS against 0fc0868

@lalaps lalaps bot force-pushed the lalaps/npm-force-partial-fix branch 2 times, most recently from 3c47f67 to 9547b6f Compare March 29, 2022 00:05
@lalaps lalaps bot force-pushed the lalaps/npm-force-partial-fix branch 2 times, most recently from 6cdafea to 08b64d2 Compare April 8, 2022 00:05
@lalaps lalaps bot force-pushed the lalaps/npm-force-partial-fix branch 2 times, most recently from b8e6ed3 to 7806bef Compare May 3, 2022 00:04
@sonarqubecloud
Copy link

sonarqubecloud bot commented May 3, 2022

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

@lalaps lalaps bot force-pushed the lalaps/npm-force-partial-fix branch 4 times, most recently from c989401 to f40ac35 Compare July 12, 2022 00:07
@lalaps lalaps bot force-pushed the lalaps/npm-force-partial-fix branch 3 times, most recently from 659070b to a6f8902 Compare July 26, 2022 00:05
@lalaps lalaps bot force-pushed the lalaps/npm-force-partial-fix branch from a6f8902 to b52fdc6 Compare August 11, 2022 00:07
@sonarqubecloud
Copy link

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

@lalaps lalaps bot force-pushed the lalaps/npm-force-partial-fix branch 2 times, most recently from 000f64d to e49f605 Compare October 21, 2022 00:05
@lalaps lalaps bot force-pushed the lalaps/npm-force-partial-fix branch from e49f605 to 9d90231 Compare November 4, 2022 01:06
@lalaps lalaps bot force-pushed the lalaps/npm-force-partial-fix branch from 9d90231 to 0fc0868 Compare November 29, 2022 01:06
@sonarqubecloud
Copy link

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant