Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[stable29] Fix npm audit #2622

Open
wants to merge 1 commit into
base: stable29
Choose a base branch
from

Conversation

nextcloud-command
Copy link
Contributor

@nextcloud-command nextcloud-command commented Aug 25, 2024

Audit report

This audit fix resolves 29 of the total 41 vulnerabilities found in your project.

Updated dependencies

Fixed vulnerabilities

@nextcloud/dialogs #

@nextcloud/files #

  • Caused by vulnerable dependency:
  • Affected versions: >=1.1.0
  • Package usage:
    • node_modules/@nextcloud/files

@nextcloud/moment #

  • Caused by vulnerable dependency:
  • Affected versions: >=1.1.1
  • Package usage:
    • node_modules/@nextcloud/moment

@nextcloud/typings #

  • Caused by vulnerable dependency:
  • Affected versions: 1.7.0 - 1.8.0
  • Package usage:
    • node_modules/@nextcloud/typings

@nextcloud/upload #

@nextcloud/webpack-vue-config #

@vue/component-compiler-utils #

  • Caused by vulnerable dependency:
  • Affected versions: *
  • Package usage:
    • node_modules/@vue/component-compiler-utils

@vue/test-utils #

  • Caused by vulnerable dependency:
  • Affected versions: <=1.3.6
  • Package usage:
    • node_modules/@vue/test-utils

axios #

  • Axios Cross-Site Request Forgery Vulnerability
  • Severity: moderate (CVSS 6.5)
  • Reference: GHSA-wf5p-g6vw-rhxx
  • Affected versions: 0.8.1 - 0.27.2 || 1.3.2 - 1.7.3
  • Package usage:
    • node_modules/@nextcloud/axios/node_modules/axios
    • node_modules/axios
    • node_modules/wait-on/node_modules/axios

body-parser #

  • body-parser vulnerable to denial of service when url encoding is enabled
  • Severity: high (CVSS 7.5)
  • Reference: GHSA-qwcr-r2fm-qrc7
  • Affected versions: <1.20.3
  • Package usage:
    • node_modules/body-parser

cookie #

  • cookie accepts cookie name, path, and domain with out of bounds characters
  • Severity: low
  • Reference: GHSA-pxg6-pf52-xh8x
  • Affected versions: <0.7.0
  • Package usage:
    • node_modules/cookie

cross-spawn #

  • Regular Expression Denial of Service (ReDoS) in cross-spawn
  • Severity: high (CVSS 7.5)
  • Reference: GHSA-3xgq-45jj-v275
  • Affected versions: 7.0.0 - 7.0.4
  • Package usage:
    • node_modules/cross-spawn

dompurify #

  • DOMPurify allows tampering by prototype pollution
  • Severity: high (CVSS 7)
  • Reference: GHSA-mmhx-hmjr-r674
  • Affected versions: 3.0.0 - 3.1.2
  • Package usage:
    • node_modules/dompurify

elliptic #

  • Elliptic's EDDSA missing signature length check
  • Severity: low (CVSS 5.3)
  • Reference: GHSA-f7q4-pwc6-w24p
  • Affected versions: <=6.5.7
  • Package usage:
    • node_modules/elliptic

express #

  • express vulnerable to XSS via response.redirect()
  • Severity: low (CVSS 5)
  • Reference: GHSA-qw6h-vgh9-j6wx
  • Affected versions: <=4.21.1 || 5.0.0-alpha.1 - 5.0.0
  • Package usage:
    • node_modules/express

http-proxy-middleware #

  • Denial of service in http-proxy-middleware
  • Severity: high (CVSS 7.5)
  • Reference: GHSA-c7qv-q95q-8v27
  • Affected versions: <2.0.7
  • Package usage:
    • node_modules/http-proxy-middleware

micromatch #

  • Regular Expression Denial of Service (ReDoS) in micromatch
  • Severity: moderate (CVSS 5.3)
  • Reference: GHSA-952p-6rrq-rcjv
  • Affected versions: <4.0.8
  • Package usage:
    • node_modules/micromatch

nanoid #

  • Predictable results in nanoid generation when given non-integer values
  • Severity: moderate (CVSS 4.3)
  • Reference: GHSA-mwcw-c2x4-8c55
  • Affected versions: <3.3.8
  • Package usage:
    • node_modules/nanoid

path-to-regexp #

  • path-to-regexp outputs backtracking regular expressions
  • Severity: high (CVSS 7.5)
  • Reference: GHSA-9wv6-86v2-598j
  • Affected versions: <=0.1.11
  • Package usage:
    • node_modules/path-to-regexp

postcss #

  • PostCSS line return parsing error
  • Severity: moderate (CVSS 5.3)
  • Reference: GHSA-7fh5-64p2-3v2j
  • Affected versions: <8.4.31
  • Package usage:
    • node_modules/@vue/component-compiler-utils/node_modules/postcss

rollup #

  • DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
  • Severity: high (CVSS 6.4)
  • Reference: GHSA-gcx4-mw62-g8wm
  • Affected versions: <2.79.2
  • Package usage:
    • node_modules/rollup

send #

  • send vulnerable to template injection that can lead to XSS
  • Severity: low (CVSS 5)
  • Reference: GHSA-m6fv-jmcg-4jfg
  • Affected versions: <0.19.0
  • Package usage:
    • node_modules/send

serve-static #

  • serve-static vulnerable to template injection that can lead to XSS
  • Severity: low (CVSS 5)
  • Reference: GHSA-cm22-4g7w-348p
  • Affected versions: <=1.16.0
  • Package usage:
    • node_modules/serve-static

vue-loader #

  • Caused by vulnerable dependency:
  • Affected versions: 15.0.0-beta.1 - 15.11.1
  • Package usage:
    • node_modules/vue-loader

vue-resize #

  • Caused by vulnerable dependency:
  • Affected versions: 0.4.0 - 1.0.1
  • Package usage:
    • node_modules/vue-resize

vue-template-compiler #

  • vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
  • Severity: moderate (CVSS 4.2)
  • Reference: GHSA-g3ch-rx76-35fx
  • Affected versions: >=2.0.0
  • Package usage:
    • node_modules/vue-template-compiler

vuex #

  • Caused by vulnerable dependency:
  • Affected versions: 3.1.3 - 3.6.2
  • Package usage:
    • node_modules/vuex

webdav #

  • Caused by vulnerable dependency:
  • Affected versions: 2.0.0-rc1 - 4.11.4
  • Package usage:
    • node_modules/webdav

webpack #

  • Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS
  • Severity: moderate (CVSS 6.4)
  • Reference: GHSA-4vvj-4cpr-p986
  • Affected versions: 5.0.0-alpha.0 - 5.93.0
  • Package usage:
    • node_modules/webpack

@nextcloud-command nextcloud-command added 3. to review Waiting for reviews dependencies Pull requests that update a dependency file labels Aug 25, 2024
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable29-fix-npm-audit branch from 3622bb2 to 518479d Compare September 1, 2024 03:37
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable29-fix-npm-audit branch 2 times, most recently from d722eb4 to 2aaa0c7 Compare September 15, 2024 03:31
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable29-fix-npm-audit branch from 2aaa0c7 to deff4e6 Compare September 22, 2024 03:32
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable29-fix-npm-audit branch from deff4e6 to c3ab25a Compare September 29, 2024 03:44
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable29-fix-npm-audit branch 2 times, most recently from 68c5ce8 to 798abed Compare October 13, 2024 03:38
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable29-fix-npm-audit branch from 798abed to d016f21 Compare October 20, 2024 03:33
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable29-fix-npm-audit branch 2 times, most recently from b97dc41 to 977eaaf Compare November 3, 2024 03:35
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable29-fix-npm-audit branch from 977eaaf to 01eb511 Compare November 10, 2024 03:15
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable29-fix-npm-audit branch 2 times, most recently from 01d4f98 to 1eec2dc Compare November 24, 2024 03:33
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable29-fix-npm-audit branch 2 times, most recently from 7e0c072 to 0fb8406 Compare December 8, 2024 03:44
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable29-fix-npm-audit branch from 0fb8406 to d02147c Compare December 15, 2024 03:41
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable29-fix-npm-audit branch from d02147c to 6e496e4 Compare December 22, 2024 03:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3. to review Waiting for reviews dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants