search

FredrikOseberg / react-chatbot-kit

MIT License
299 stars 139 forks source link

Fix npm vulnerabilities #43

Open luca-nardelli-memori opened 3 years ago

luca-nardelli-memori commented 3 years ago

Hello Fredrik, thanks for your nice chatbot!

Would be possible for you to fix the npm vulnerabilities ?

There are several reference to vulnerable packages: npm audit report

serialize-javascript <=3.0.0 Severity: high Cross-Site Scripting - https://npmjs.com/advisories/1426 Remote Code Execution - https://npmjs.com/advisories/1548 No fix available node_modules/uglifyjs-webpack-plugin/node_modules/serialize-javascript uglifyjs-webpack-plugin >=1.1.3 Depends on vulnerable versions of serialize-javascript node_modules/uglifyjs-webpack-plugin webpack 4.3.0 - 4.25.1 Depends on vulnerable versions of uglifyjs-webpack-plugin node_modules/react-util-kit/node_modules/webpack react-util-kit * Depends on vulnerable versions of webpack node_modules/react-util-kit

4 vulnerabilities (3 moderate, 1 high)

FredrikOseberg commented 3 years ago

Hello Fredrik, thanks for your nice chatbot!

Would be possible for you to fix the npm vulnerabilities ?

There are several reference to vulnerable packages: npm audit report

serialize-javascript <=3.0.0 Severity: high Cross-Site Scripting - https://npmjs.com/advisories/1426 Remote Code Execution - https://npmjs.com/advisories/1548 No fix available node_modules/uglifyjs-webpack-plugin/node_modules/serialize-javascript uglifyjs-webpack-plugin >=1.1.3 Depends on vulnerable versions of serialize-javascript node_modules/uglifyjs-webpack-plugin webpack 4.3.0 - 4.25.1 Depends on vulnerable versions of uglifyjs-webpack-plugin node_modules/react-util-kit/node_modules/webpack react-util-kit * Depends on vulnerable versions of webpack node_modules/react-util-kit

4 vulnerabilities (3 moderate, 1 high)

Thanks! Yes, I have it on my todo list and should be a part of a revamp that I'm planning to release after easter.