Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[stable30] Fix npm audit #47309

Merged
merged 1 commit into from
Aug 18, 2024
Merged

Conversation

nextcloud-command
Copy link
Contributor

Audit report

This audit fix resolves 12 of the total 15 vulnerabilities found in your project.

Updated dependencies

Fixed vulnerabilities

@jimp/core #

  • Caused by vulnerable dependency:
  • Affected versions: <=0.21.4--canary.1163.d07ed6254d130e2995d24101e93427ec091016e6.0
  • Package usage:
    • node_modules/@jimp/core

@jimp/custom #

  • Caused by vulnerable dependency:
  • Affected versions: <=0.21.4--canary.1163.d07ed6254d130e2995d24101e93427ec091016e6.0
  • Package usage:
    • node_modules/@jimp/custom

@testing-library/vue #

@vue/component-compiler-utils #

  • Caused by vulnerable dependency:
  • Affected versions: *
  • Package usage:
    • node_modules/@vue/component-compiler-utils

@vue/test-utils #

  • Caused by vulnerable dependency:
  • Affected versions: <=1.3.6
  • Package usage:
    • node_modules/@vue/test-utils

axios #

  • Server-Side Request Forgery in axios
  • Severity: high
  • Reference: GHSA-8hc4-vh64-cxmj
  • Affected versions: 1.3.2 - 1.7.3
  • Package usage:
    • node_modules/axios

elliptic #

  • Elliptic's EDDSA missing signature length check
  • Severity: low (CVSS 5.3)
  • Reference: GHSA-f7q4-pwc6-w24p
  • Affected versions: 2.0.0 - 6.5.6
  • Package usage:
    • node_modules/elliptic

node-vibrant #

  • Caused by vulnerable dependency:
  • Affected versions: 3.1.5 - 3.1.6
  • Package usage:
    • node_modules/node-vibrant

phin #

  • phin may include sensitive headers in subsequent requests after redirect
  • Severity: moderate (CVSS 4.3)
  • Reference: GHSA-x565-32qp-m3vf
  • Affected versions: <3.7.1
  • Package usage:
    • node_modules/phin

postcss #

  • PostCSS line return parsing error
  • Severity: moderate (CVSS 5.3)
  • Reference: GHSA-7fh5-64p2-3v2j
  • Affected versions: <8.4.31
  • Package usage:
    • node_modules/@vue/component-compiler-utils/node_modules/postcss

select2 #

  • Improper Neutralization of Input During Web Page Generation in Select2
  • Severity: moderate (CVSS 6.1)
  • Reference: GHSA-rf66-hmqf-q3fc
  • Affected versions: <4.0.6
  • Package usage:
    • node_modules/select2

vue-loader #

  • Caused by vulnerable dependency:
  • Affected versions: 15.0.0-beta.1 - 15.11.1
  • Package usage:
    • node_modules/vue-loader

@susnux susnux requested a review from a team August 18, 2024 10:30
@susnux susnux added this to the Nextcloud 30 milestone Aug 18, 2024
Signed-off-by: GitHub <noreply@github.com>
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable30-fix-npm-audit branch from a8a5d1c to 6c7726a Compare August 18, 2024 11:33
@skjnldsv skjnldsv merged commit fb6616e into stable30 Aug 18, 2024
110 of 111 checks passed
@skjnldsv skjnldsv deleted the automated/noid/stable30-fix-npm-audit branch August 18, 2024 15:30
@skjnldsv skjnldsv mentioned this pull request Aug 22, 2024
44 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3. to review Waiting for reviews dependencies
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants