build: npm audit 2024 december #118

melsener · 2024-12-09T07:44:07Z

Change description

Before

# npm audit report

axios  0.8.1 - 0.27.2
Severity: moderate
Axios Cross-Site Request Forgery Vulnerability - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
fix available via `npm audit fix --force`
Will install axios@1.7.9, which is a breaking change
node_modules/axios

body-parser  <1.20.3
Severity: high
body-parser vulnerable to denial of service when url encoding is enabled - https://github.com/advisories/GHSA-qwcr-r2fm-qrc7
fix available via `npm audit fix`
node_modules/body-parser
  express  <=4.21.1 || 5.0.0-alpha.1 - 5.0.0
  Depends on vulnerable versions of body-parser
  Depends on vulnerable versions of cookie
  Depends on vulnerable versions of path-to-regexp
  Depends on vulnerable versions of send
  Depends on vulnerable versions of serve-static
  node_modules/express

braces  <3.0.3
Severity: high
Uncontrolled resource consumption in braces - https://github.com/advisories/GHSA-grv7-fg5c-xmjg
fix available via `npm audit fix`
node_modules/braces

cookie  <0.7.0
cookie accepts cookie name, path, and domain with out of bounds characters - https://github.com/advisories/GHSA-pxg6-pf52-xh8x
fix available via `npm audit fix`
node_modules/cookie

cross-spawn  <6.0.6 || >=7.0.0 <7.0.5
Severity: high
Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275
Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275
fix available via `npm audit fix`
node_modules/cross-spawn
node_modules/execa/node_modules/cross-spawn


got  <11.8.5
Severity: moderate
Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97
fix available via `npm audit fix --force`
Will install latest-version@9.0.0, which is a breaking change
node_modules/got
  package-json  <=6.5.0
  Depends on vulnerable versions of got
  node_modules/package-json
    latest-version  0.2.0 - 5.1.0
    Depends on vulnerable versions of package-json
    node_modules/latest-version
      update-notifier  0.2.0 - 5.1.0
      Depends on vulnerable versions of latest-version
      node_modules/update-notifier

jsonwebtoken  <=8.5.1
Severity: high
jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() - https://github.com/advisories/GHSA-qwph-4952-7xr6
jsonwebtoken unrestricted key type could lead to legacy keys usage  - https://github.com/advisories/GHSA-8cf7-32gw-wr33
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC - https://github.com/advisories/GHSA-hjrf-2m68-5959
fix available via `npm audit fix --force`
Will install jsonwebtoken@9.0.2, which is a breaking change
node_modules/jsonwebtoken

micromatch  <4.0.8
Severity: moderate
Regular Expression Denial of Service (ReDoS) in micromatch - https://github.com/advisories/GHSA-952p-6rrq-rcjv
fix available via `npm audit fix`
node_modules/micromatch

path-to-regexp  <=0.1.11
Severity: high
path-to-regexp outputs backtracking regular expressions - https://github.com/advisories/GHSA-9wv6-86v2-598j
Unpatched `path-to-regexp` ReDoS in 0.1.x - https://github.com/advisories/GHSA-rhx6-c78j-4q9w
fix available via `npm audit fix`
node_modules/path-to-regexp

send  <0.19.0
send vulnerable to template injection that can lead to XSS - https://github.com/advisories/GHSA-m6fv-jmcg-4jfg
fix available via `npm audit fix`
node_modules/send
  serve-static  <=1.16.0
  Depends on vulnerable versions of send
  node_modules/serve-static


ws  7.0.0 - 7.5.9
Severity: high
ws affected by a DoS when handling a request with many HTTP headers - https://github.com/advisories/GHSA-3h5v-q93c-6h6q
fix available via `npm audit fix`
node_modules/ws

16 vulnerabilities (3 low, 6 moderate, 7 high)

After:

# npm audit report

got  <11.8.5
Severity: moderate
Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97
fix available via `npm audit fix --force`
Will install latest-version@9.0.0, which is a breaking change
node_modules/got
  package-json  <=6.5.0
  Depends on vulnerable versions of got
  node_modules/package-json
    latest-version  0.2.0 - 5.1.0
    Depends on vulnerable versions of package-json
    node_modules/latest-version
      update-notifier  0.2.0 - 5.1.0
      Depends on vulnerable versions of latest-version
      node_modules/update-notifier

4 moderate severity vulnerabilities

References

jsonwebtoken - Migration Notes: v8 to v9

Type of change

Bug fix (fixes an issue)
New feature (adds functionality)

Related issues

Fix #1

Checklists

Development

Lint rules pass locally
Application changes have been tested thoroughly
Automated tests covering modified code pass

Security

Security impact of change has been considered
Code follows company security practices and guidelines

Code review

Pull request has a descriptive title and context useful to a reviewer. Screenshots or screencasts are attached as necessary
"Ready for review" label attached and reviewers assigned
Changes have been reviewed by at least one other contributor
Pull request linked to task tracker where applicable

melsener · 2024-12-10T14:09:29Z

.eslintrc.js

@@ -28,9 +28,14 @@ module.exports = {
        "no-process-exit": "off",
        "no-process-env": "off",
        "no-undefined": "off",
-        "@typescript-eslint/no-explicit-any": ["error", { "ignoreRestArgs": true }],


typescript-eslint/typescript-eslint#776

melsener · 2024-12-10T14:10:12Z

src/util/logger.ts

@@ -41,7 +41,7 @@ const logger = winston.createLogger({
 // Workaround to ensure all logs are written into the file before process exit
 const fileLogWatcher = new EventEmitter();
 fileTransport.on("open", () => {
-    // eslint-disable-next-line @typescript-eslint/ban-ts-ignore


typescript-eslint/typescript-eslint#2286

melsener added 2 commits December 9, 2024 09:46

fix: run npm audit fix

88d6df7

build: update axios

1d64e4f

melsener force-pushed the fix/npm-audit-2024-december branch from eb45412 to 1d64e4f Compare December 9, 2024 16:08

fix: fix lint errors

788e0c0

melsener commented Dec 10, 2024

View reviewed changes

melsener added 2 commits December 11, 2024 17:07

fix: Fix axios errors on tests

5dcba28

build(deps): upgrade jsonwebtoken version

dadaf3d

melsener force-pushed the fix/npm-audit-2024-december branch from 9a80973 to dadaf3d Compare December 11, 2024 15:07

melsener changed the title ~~fix: npm audit 2024 december~~ build: npm audit 2024 december Dec 12, 2024

melsener marked this pull request as ready for review December 12, 2024 15:54

melsener requested review from aykutbulca, yuksely and okan-cakmak December 12, 2024 15:54

aykutbulca approved these changes Dec 13, 2024

View reviewed changes

okan-cakmak approved these changes Dec 17, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build: npm audit 2024 december #118

build: npm audit 2024 december #118

melsener commented Dec 9, 2024 •

edited

Loading

melsener Dec 10, 2024

melsener Dec 10, 2024

build: npm audit 2024 december #118

Are you sure you want to change the base?

build: npm audit 2024 december #118

Conversation

melsener commented Dec 9, 2024 • edited Loading

Change description

References

Type of change

Related issues

Checklists

Development

Security

Code review

melsener Dec 10, 2024

Choose a reason for hiding this comment

melsener Dec 10, 2024

Choose a reason for hiding this comment

melsener commented Dec 9, 2024 •

edited

Loading