Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[master] Fix npm audit #2766

Merged
merged 7 commits into from
Feb 20, 2025
Merged

[master] Fix npm audit #2766

merged 7 commits into from
Feb 20, 2025

Conversation

nextcloud-command
Copy link
Contributor

@nextcloud-command nextcloud-command commented Jan 19, 2025 •
edited
Loading

Audit report

This audit fix resolves 33 of the total 36 vulnerabilities found in your project.

Updated dependencies

Fixed vulnerabilities

@linusborg/vue-simple-portal #

  • Caused by vulnerable dependency:
  • Affected versions: *
  • Package usage:
    • node_modules/@linusborg/vue-simple-portal

@nextcloud/dialogs #

  • Caused by vulnerable dependency:
  • Affected versions: >=2.0.0
  • Package usage:
    • node_modules/@nextcloud/dialogs
    • node_modules/@nextcloud/upload/node_modules/@nextcloud/dialogs

@nextcloud/l10n #

  • Caused by vulnerable dependency:
  • Affected versions: 1.1.0 - 3.1.0
  • Package usage:
    • node_modules/@nextcloud/dialogs/node_modules/@nextcloud/l10n
    • node_modules/@nextcloud/files/node_modules/@nextcloud/l10n
    • node_modules/@nextcloud/l10n
    • node_modules/@nextcloud/moment/node_modules/@nextcloud/l10n
    • node_modules/@nextcloud/vue/node_modules/@nextcloud/l10n

@nextcloud/moment #

  • Caused by vulnerable dependency:
  • Affected versions: >=1.1.1
  • Package usage:
    • node_modules/@nextcloud/moment

@nextcloud/upload #

@nextcloud/vue #

@nextcloud/vue-select #

  • Caused by vulnerable dependency:
  • Affected versions: *
  • Package usage:
    • node_modules/@nextcloud/vue-select

@nextcloud/webpack-vue-config #

@vue/component-compiler-utils #

  • Caused by vulnerable dependency:
  • Affected versions: *
  • Package usage:
    • node_modules/@vue/component-compiler-utils

@vue/test-utils #

  • Caused by vulnerable dependency:
  • Affected versions: <=1.3.6
  • Package usage:
    • node_modules/@vue/test-utils

axios #

  • Axios Cross-Site Request Forgery Vulnerability
  • Severity: moderate (CVSS 6.5)
  • Reference: GHSA-wf5p-g6vw-rhxx
  • Affected versions: 0.8.1 - 0.27.2 || 1.3.2 - 1.7.3
  • Package usage:
    • node_modules/axios
    • node_modules/wait-on/node_modules/axios

body-parser #

  • body-parser vulnerable to denial of service when url encoding is enabled
  • Severity: high (CVSS 7.5)
  • Reference: GHSA-qwcr-r2fm-qrc7
  • Affected versions: <1.20.3
  • Package usage:
    • node_modules/body-parser

cookie #

  • cookie accepts cookie name, path, and domain with out of bounds characters
  • Severity: low
  • Reference: GHSA-pxg6-pf52-xh8x
  • Affected versions: <0.7.0
  • Package usage:
    • node_modules/cookie

cross-spawn #

  • Regular Expression Denial of Service (ReDoS) in cross-spawn
  • Severity: high (CVSS 7.5)
  • Reference: GHSA-3xgq-45jj-v275
  • Affected versions: 7.0.0 - 7.0.4
  • Package usage:
    • node_modules/cross-spawn

express #

  • express vulnerable to XSS via response.redirect()
  • Severity: low (CVSS 5)
  • Reference: GHSA-qw6h-vgh9-j6wx
  • Affected versions: <=4.21.1 || 5.0.0-alpha.1 - 5.0.0
  • Package usage:
    • node_modules/express

floating-vue #

  • Caused by vulnerable dependency:
  • Affected versions: <=1.0.0-beta.19
  • Package usage:
    • node_modules/floating-vue

http-proxy-middleware #

  • Denial of service in http-proxy-middleware
  • Severity: high (CVSS 7.5)
  • Reference: GHSA-c7qv-q95q-8v27
  • Affected versions: <2.0.7
  • Package usage:
    • node_modules/http-proxy-middleware

micromatch #

  • Regular Expression Denial of Service (ReDoS) in micromatch
  • Severity: moderate (CVSS 5.3)
  • Reference: GHSA-952p-6rrq-rcjv
  • Affected versions: <4.0.8
  • Package usage:
    • node_modules/micromatch

nanoid #

  • Predictable results in nanoid generation when given non-integer values
  • Severity: moderate (CVSS 4.3)
  • Reference: GHSA-mwcw-c2x4-8c55
  • Affected versions: <3.3.8
  • Package usage:
    • node_modules/nanoid

node-gettext #

  • node-gettext vulnerable to Prototype Pollution
  • Severity: high (CVSS 5.9)
  • Reference: GHSA-g974-hxvm-x689
  • Affected versions: *
  • Package usage:
    • node_modules/node-gettext

path-to-regexp #

  • Unpatched path-to-regexp ReDoS in 0.1.x
  • Severity: high
  • Reference: GHSA-rhx6-c78j-4q9w
  • Affected versions: <=0.1.11
  • Package usage:
    • node_modules/path-to-regexp

postcss #

  • PostCSS line return parsing error
  • Severity: moderate (CVSS 5.3)
  • Reference: GHSA-7fh5-64p2-3v2j
  • Affected versions: <8.4.31
  • Package usage:
    • node_modules/@vue/component-compiler-utils/node_modules/postcss

send #

  • send vulnerable to template injection that can lead to XSS
  • Severity: low (CVSS 5)
  • Reference: GHSA-m6fv-jmcg-4jfg
  • Affected versions: <0.19.0
  • Package usage:
    • node_modules/send

serve-static #

  • serve-static vulnerable to template injection that can lead to XSS
  • Severity: low (CVSS 5)
  • Reference: GHSA-cm22-4g7w-348p
  • Affected versions: <=1.16.0
  • Package usage:
    • node_modules/serve-static

undici #

  • Use of Insufficiently Random Values in undici
  • Severity: moderate (CVSS 6.8)
  • Reference: GHSA-c76h-2ccp-4975
  • Affected versions: 4.5.0 - 5.28.4
  • Package usage:
    • node_modules/undici

vue #

  • ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function
  • Severity: low (CVSS 3.7)
  • Reference: GHSA-5j4c-8p2g-v4jx
  • Affected versions: 2.0.0-alpha.1 - 2.7.16
  • Package usage:
    • node_modules/vue

vue-frag #

  • Caused by vulnerable dependency:
  • Affected versions: >=1.3.1
  • Package usage:
    • node_modules/vue-frag

vue-loader #

  • Caused by vulnerable dependency:
  • Affected versions: 15.0.0-beta.1 - 15.11.1
  • Package usage:
    • node_modules/vue-loader

vue-resize #

  • Caused by vulnerable dependency:
  • Affected versions: 0.4.0 - 1.0.1
  • Package usage:
    • node_modules/vue-resize

vue-template-compiler #

  • vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
  • Severity: moderate (CVSS 4.2)
  • Reference: GHSA-g3ch-rx76-35fx
  • Affected versions: >=2.0.0
  • Package usage:
    • node_modules/vue-template-compiler

vue2-datepicker #

  • Caused by vulnerable dependency:
  • Affected versions: <=1.9.8 || 3.0.2 - 3.11.1
  • Package usage:
    • node_modules/vue2-datepicker

vuex #

  • Caused by vulnerable dependency:
  • Affected versions: 3.1.3 - 3.6.2
  • Package usage:
    • node_modules/vuex

webdav #

  • Caused by vulnerable dependency:
  • Affected versions: 2.0.0-rc1 - 4.11.4
  • Package usage:
    • node_modules/webdav

@nextcloud-command nextcloud-command added 3. to review Waiting for reviews dependencies Pull requests that update a dependency file labels Jan 19, 2025
@nextcloud-command nextcloud-command force-pushed the automated/noid/master-fix-npm-audit branch from 43a2d5f to 247afe1 Compare January 26, 2025 03:26
@nextcloud-command nextcloud-command force-pushed the automated/noid/master-fix-npm-audit branch from 247afe1 to 84e728f Compare February 2, 2025 03:26
@nextcloud-command nextcloud-command force-pushed the automated/noid/master-fix-npm-audit branch 2 times, most recently from 5490e65 to b2116be Compare February 12, 2025 16:03
@nextcloud-command nextcloud-command force-pushed the automated/noid/master-fix-npm-audit branch from b2116be to 9fab504 Compare February 16, 2025 03:34
@artonge artonge force-pushed the automated/noid/master-fix-npm-audit branch from 9fab504 to 78e019c Compare February 19, 2025 14:16
@artonge
Copy link
Collaborator

artonge commented Feb 19, 2025

/compile amend /

@artonge artonge force-pushed the automated/noid/master-fix-npm-audit branch 3 times, most recently from d0a820a to cc159a6 Compare February 20, 2025 09:27
@artonge
fix(deps): Fix npm audit
62af0f3 
Signed-off-by: GitHub <[email protected]>
Signed-off-by: Louis Chemineau <[email protected]>
@artonge
chore: Bump @nextcloud/webpack-vue-config to v6.2.0
ca7d072 
Signed-off-by: Louis Chemineau <[email protected]>
@artonge
chore: Install vue-demi
765b720 
Signed-off-by: Louis Chemineau <[email protected]>
@artonge artonge force-pushed the automated/noid/master-fix-npm-audit branch from cc159a6 to 765b720 Compare February 20, 2025 09:38
@artonge
Copy link
Collaborator

artonge commented Feb 20, 2025

/compile amend /

@nextcloud-command nextcloud-command force-pushed the automated/noid/master-fix-npm-audit branch from 765b720 to 8929344 Compare February 20, 2025 09:57
@artonge artonge force-pushed the automated/noid/master-fix-npm-audit branch from 8929344 to 3f78770 Compare February 20, 2025 10:39
@artonge
Copy link
Collaborator

artonge commented Feb 20, 2025

/compile /

@nextcloud-command
chore(assets): Recompile assets
083fca1 
Signed-off-by: nextcloud-command <[email protected]>
@artonge artonge merged commit c2898f7 into master Feb 20, 2025
46 checks passed
@artonge artonge deleted the automated/noid/master-fix-npm-audit branch February 20, 2025 11:32
@artonge artonge mentioned this pull request Feb 20, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@artonge artonge artonge approved these changes

Assignees
No one assigned
Labels
3. to review Waiting for reviews dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@nextcloud-command @artonge