Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[stable29] Fix npm audit #1554

Merged
merged 1 commit into from
Sep 30, 2024

Conversation

nextcloud-command
Copy link
Contributor

@nextcloud-command nextcloud-command commented Aug 25, 2024

Audit report

This audit fix resolves 17 of the total 19 vulnerabilities found in your project.

Updated dependencies

Fixed vulnerabilities

@nextcloud/l10n #

  • Caused by vulnerable dependency:
  • Affected versions: >=1.1.0
  • Package usage:
    • node_modules/@nextcloud/l10n

@nextcloud/password-confirmation #

  • Caused by vulnerable dependency:
  • Affected versions: >=3.0.0
  • Package usage:
    • node_modules/@nextcloud/password-confirmation

@nextcloud/vue #

  • Caused by vulnerable dependency:
  • Affected versions: >=1.4.0
  • Package usage:
    • node_modules/@nextcloud/vue

@vue/component-compiler-utils #

  • Caused by vulnerable dependency:
  • Affected versions: *
  • Package usage:
    • node_modules/@vue/component-compiler-utils

@vue/test-utils #

  • Caused by vulnerable dependency:
  • Affected versions: <=1.3.6
  • Package usage:
    • node_modules/@vue/test-utils

body-parser #

  • body-parser vulnerable to denial of service when url encoding is enabled
  • Severity: high (CVSS 7.5)
  • Reference: GHSA-qwcr-r2fm-qrc7
  • Affected versions: <1.20.3
  • Package usage:
    • node_modules/body-parser

dompurify #

  • DOMPurify allows tampering by prototype pollution
  • Severity: high (CVSS 7)
  • Reference: GHSA-mmhx-hmjr-r674
  • Affected versions: 3.0.0 - 3.1.2
  • Package usage:
    • node_modules/dompurify

express #

  • express vulnerable to XSS via response.redirect()
  • Severity: moderate (CVSS 5)
  • Reference: GHSA-qw6h-vgh9-j6wx
  • Affected versions: <=4.19.2 || 5.0.0-alpha.1 - 5.0.0-beta.3
  • Package usage:
    • node_modules/express

micromatch #

  • Regular Expression Denial of Service (ReDoS) in micromatch
  • Severity: moderate (CVSS 5.3)
  • Reference: GHSA-952p-6rrq-rcjv
  • Affected versions: <4.0.8
  • Package usage:
    • node_modules/micromatch

node-gettext #

  • node-gettext vulnerable to Prototype Pollution
  • Severity: moderate (CVSS 5.9)
  • Reference: GHSA-g974-hxvm-x689
  • Affected versions: *
  • Package usage:
    • node_modules/node-gettext

path-to-regexp #

  • path-to-regexp outputs backtracking regular expressions
  • Severity: high (CVSS 7.5)
  • Reference: GHSA-9wv6-86v2-598j
  • Affected versions: <0.1.10
  • Package usage:
    • node_modules/express/node_modules/path-to-regexp

postcss #

  • PostCSS line return parsing error
  • Severity: moderate (CVSS 5.3)
  • Reference: GHSA-7fh5-64p2-3v2j
  • Affected versions: <8.4.31
  • Package usage:
    • node_modules/@vue/component-compiler-utils/node_modules/postcss

send #

  • send vulnerable to template injection that can lead to XSS
  • Severity: moderate (CVSS 5)
  • Reference: GHSA-m6fv-jmcg-4jfg
  • Affected versions: <0.19.0
  • Package usage:
    • node_modules/send

serve-static #

  • serve-static vulnerable to template injection that can lead to XSS
  • Severity: moderate (CVSS 5)
  • Reference: GHSA-cm22-4g7w-348p
  • Affected versions: <=1.16.0
  • Package usage:
    • node_modules/serve-static

vue-loader #

  • Caused by vulnerable dependency:
  • Affected versions: 15.0.0-beta.1 - 15.11.1
  • Package usage:
    • node_modules/vue-loader

vue-template-compiler #

  • vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
  • Severity: moderate (CVSS 4.2)
  • Reference: GHSA-g3ch-rx76-35fx
  • Affected versions: >=2.0.0
  • Package usage:
    • node_modules/vue-template-compiler

webpack #

  • Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS
  • Severity: moderate (CVSS 6.4)
  • Reference: GHSA-4vvj-4cpr-p986
  • Affected versions: 5.0.0-alpha.0 - 5.93.0
  • Package usage:
    • node_modules/webpack

Copy link

codecov bot commented Aug 25, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 44.29%. Comparing base (e081130) to head (aaed488).
Report is 4 commits behind head on stable29.

Additional details and impacted files
@@             Coverage Diff             @@
##             stable29    #1554   +/-   ##
===========================================
  Coverage       44.29%   44.29%           
  Complexity         99       99           
===========================================
  Files              19       19           
  Lines             298      298           
===========================================
  Hits              132      132           
  Misses            166      166           
Flag Coverage Δ
unittests 44.29% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@nextcloud-command nextcloud-command force-pushed the automated/noid/stable29-fix-npm-audit branch from 8837cbd to 7a79a99 Compare September 1, 2024 03:28
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable29-fix-npm-audit branch from 7a79a99 to bf1b3e0 Compare September 15, 2024 03:21
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable29-fix-npm-audit branch from bf1b3e0 to f174397 Compare September 22, 2024 03:26
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable29-fix-npm-audit branch from f174397 to aaed488 Compare September 29, 2024 03:30
@ChristophWurst ChristophWurst merged commit 9e3a8c3 into stable29 Sep 30, 2024
18 of 19 checks passed
@ChristophWurst ChristophWurst deleted the automated/noid/stable29-fix-npm-audit branch September 30, 2024 10:09
@Altahrim Altahrim mentioned this pull request Oct 1, 2024
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants