Closed Streppel closed 6 years ago
Fix #305
Running dependency_spy on the project gave the following vulnerability:
Vulnerable: moment/runtime:^2.19.0 Title: Regular Expression Denial of Service (ReDoS) Severity: Low Source: https://snyk.io/vuln/npm:moment:20170905
So this updates the package json to the latest version available on npm.
The list spits out other vulnerabilities as well but some of them require major version upgrades, so I didn't touch them.
The full list follows:
npm: lockfile ~> package-lock.json Vulnerable: bootstrap/runtime:3.3.7 Title: Cross Site Scripting (XSS) in data-target attribute Severity: Unknown Source: https://ossindex.net/resource/package/7012139565/vulnerabilities Title: Cross-Site Scripting (XSS) Severity: Medium Source: https://snyk.io/vuln/npm:bootstrap:20160627 Vulnerable: braces/runtime:1.8.5 Title: Regular Expression Denial of Service (ReDoS) Severity: Low Source: https://snyk.io/vuln/npm:braces:20180219 Vulnerable: chownr/runtime:1.1.1 Title: Time of Check Time of Use (TOCTOU) Severity: Medium Source: https://snyk.io/vuln/npm:chownr:20180731 Vulnerable: emailjs-mime-parser/runtime:2.0.5 Title: Denial of Service (DoS) Severity: High Source: https://snyk.io/vuln/npm:emailjs-mime-parser:20180625 npm: manifest ~> package.json Vulnerable: bootstrap/runtime:^3.3.7 Title: Cross Site Scripting (XSS) in data-target attribute Severity: Unknown Source: https://ossindex.net/resource/package/7012139565/vulnerabilities Title: Cross-Site Scripting (XSS) Severity: Medium Source: https://snyk.io/vuln/npm:bootstrap:20160627 Vulnerable: lodash/runtime:^4.17.4 Title: Prototype Pollution Severity: Low Source: https://snyk.io/vuln/npm:lodash:20180130 Vulnerable: webpack-dev-server/development:^3.1.3 Title: Information Exposure Severity: Low Source: https://snyk.io/vuln/SNYK-JS-WEBPACKDEVSERVER-72405
Hey 👋
When you run npm install we already install the latest minor thx to this ^ ;)
^
Oh, alright! I closed the PR :) thanks!
Fix #305
, where 305 is the issue number.Short description of what this resolves:
Running dependency_spy on the project gave the following vulnerability:
So this updates the package json to the latest version available on npm.
The list spits out other vulnerabilities as well but some of them require major version upgrades, so I didn't touch them.
The full list follows:
Changes proposed in this pull request: