anandthakker / doiuse

:bomb: Lint CSS for browser support against caniuse database.
MIT License
1.24k stars 51 forks source link

Security warning with yargs #119

Closed JackHowa closed 3 years ago

JackHowa commented 3 years ago

https://github.com/ismay/stylelint-no-unsupported-browser-features relies upon this. And I noticed the security warning. Open to update?


                       === npm audit security report ===                        

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ stylelint-no-unsupported-browser-features [dev]              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ stylelint-no-unsupported-browser-features > doiuse > yargs > │
│               │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1500                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 low severity vulnerability in 5277 scanned packages
  1 vulnerability requires manual review. See the full report for details.
JackHowa commented 3 years ago

seeing error when I run the tests npm t after installing deps npm i:



# detecting CSS features (cursors)
ok 16 should be equivalent
ok 17 count of css3-cursors
ok 18 should be equivalent
ok 19 count of css3-cursors-newer
# detecting CSS features (font-face)
ok 20 should be equivalent
ok 21 count of fontface
# detecting CSS features (gradient)
ok 22 should be equivalent
ok 23 count of css-gradients
ok 24 should be equivalent
ok 25 count of css-repeating-gradients
# detecting CSS features (inheritance-keywords)
ok 26 should be equivalent
ok 27 count of css-initial-value
ok 28 should be equivalent
ok 29 count of css-unset-value
ok 30 should be equivalent
ok 31 count of css-revert-value
# detecting CSS features (issue17)
ok 32 should be falsy
# detecting CSS features (object-fit)
ok 33 should be equivalent
ok 34 count of object-fit
# detecting CSS features (opacity)
ok 35 should be equivalent
ok 36 count of css-opacity
# detecting CSS features (outline)
ok 37 should be equivalent
ok 38 count of outline
# detecting CSS features (overflow-wrap)
ok 39 should be equivalent
ok 40 count of wordwrap
# detecting CSS features (pointer-events)
ok 41 should be equivalent
ok 42 count of pointer-events
# detecting CSS features (queries)
ok 43 should be equivalent
ok 44 count of css-mediaqueries
ok 45 should be equivalent
ok 46 count of css-featurequeries
ok 47 should be equivalent
ok 48 count of css-media-resolution
# detecting CSS features (rem)
ok 49 should be equivalent
ok 50 count of rem
# detecting CSS features (resize)
ok 51 should be equivalent
ok 52 count of css-resize
# detecting CSS features (selectors)
ok 53 should be equivalent
ok 54 count of css-sel2
ok 55 should be equivalent
ok 56 count of css-sel3
# detecting CSS features (text-overflow)
ok 57 should be equivalent
ok 58 count of text-overflow
# detecting CSS features (viewport-units)
ok 59 should be equivalent
ok 60 count of viewport-units
# detecting CSS features (word-break)
ok 61 should be equivalent
ok 62 count of word-break
# provides list of selected browsers
Browserslist: caniuse-lite is outdated. Please run next command `npm update caniuse-lite browserslist`
ok 63 should be equivalent
# for browser request ie >= 7, safari >= 6, opera >= 10.1
ok 64 should be equivalent
ok 65 should be equivalent
ok 66 should be equivalent
ok 67 should be equivalent
ok 68 should be equivalent
ok 69 should be equivalent
# partialData only yields features partially supported by selected browser
ok 70 should be equivalent
ok 71 should be equivalent
ok 72 should be equivalent
ok 73 should be equivalent
ok 74 should be equivalent
ok 75 should be equivalent
ok 76 should be equivalent
# missingData only yields features not supported by selected browser
ok 77 should be equivalent
ok 78 should be equivalent
ok 79 should be equivalent
ok 80 should be equivalent
ok 81 should be equivalent
ok 82 should be equivalent
ok 83 should be equivalent
ok 84 should be equivalent
ok 85 should be equivalent
ok 86 should be equivalent
ok 87 should be equivalent
ok 88 should be equivalent
ok 89 should be equivalent
ok 90 should be equivalent
ok 91 should be equivalent
ok 92 should be equivalent
ok 93 should be equivalent
ok 94 should be equivalent
ok 95 should be equivalent
ok 96 should be equivalent
ok 97 should be equivalent
ok 98 should be equivalent
ok 99 should be equivalent
ok 100 should be equivalent
ok 101 should be equivalent
ok 102 should be equivalent
ok 103 should be equivalent
ok 104 should be equivalent
ok 105 should be equivalent
ok 106 should be equivalent
ok 107 should be equivalent
ok 108 should be equivalent
ok 109 should be equivalent
ok 110 should be equivalent
ok 111 should be equivalent
ok 112 should be equivalent
ok 113 should be equivalent
ok 114 should be equivalent
ok 115 should be equivalent
ok 116 should be equivalent
ok 117 should be equivalent
ok 118 should be equivalent
ok 119 should be equivalent
ok 120 should be equivalent
ok 121 should be equivalent
ok 122 should be equivalent
ok 123 should be equivalent
ok 124 should be equivalent
ok 125 should be equivalent
ok 126 should be equivalent
ok 127 should be equivalent
ok 128 should be equivalent
ok 129 should be equivalent
ok 130 should be equivalent
ok 131 should be equivalent
ok 132 should be equivalent
ok 133 should be equivalent
ok 134 should be equivalent
ok 135 should be equivalent
ok 136 should be equivalent
ok 137 should be equivalent
ok 138 should be equivalent
ok 139 should be equivalent
ok 140 should be equivalent
# leaves css alone by default
ok 141 should be equal
# calls back for unsupported feature usages
Without `from` option PostCSS could generate wrong source map and will not find Browserslist config. Set it to CSS file path or to `undefined` to prevent this warning.
ok 142 should be equivalent
ok 143 should be equivalent
ok 144 should be equivalent
ok 145 should be equivalent
ok 146 should be equivalent
ok 147 should be equivalent
ok 148 should be equivalent
ok 149 should be equivalent
ok 150 should be equal
# ignores specified features and calls back for the others
ok 151 should be equivalent
ok 152 should be equivalent
ok 153 should be equivalent
ok 154 should be equivalent
ok 155 should be equal
# ignores specified files and calls back for others
ok 156 should be false
ok 157 should be true
# ignores rules from some imported files, and not others
ok 158 should be equal
# ignores rules specified in comments
ok 159 should be equal
ok 160 inline css disabing rules must apply only to current file
# info with browserslist file
[Browserslist] Could not parse /Users/howardj/sites/doiuse/package.json. Ignoring it.

/Users/howardj/sites/doiuse/node_modules/mock-fs/lib/binding.js:1204
      throw new FSError('ENOENT', filepath);
      ^
Error: ENOENT, no such file or directory '/Users/howardj/sites/doiuse/.browserslistrc'
    at Binding.<anonymous> (/Users/howardj/sites/doiuse/node_modules/mock-fs/lib/binding.js:1204:13)
    at maybeCallback (/Users/howardj/sites/doiuse/node_modules/mock-fs/lib/binding.js:61:17)
    at Binding.access (/Users/howardj/sites/doiuse/node_modules/mock-fs/lib/binding.js:1192:3)
    at Object.existsSync (fs.js:231:11)
    at isFile (/Users/howardj/sites/doiuse/node_modules/browserslist/node.js:38:19)
    at /Users/howardj/sites/doiuse/node_modules/browserslist/node.js:253:18
    at eachParent (/Users/howardj/sites/doiuse/node_modules/browserslist/node.js:48:18)
    at Object.findConfig (/Users/howardj/sites/doiuse/node_modules/browserslist/node.js:234:20)
    at Function.loadConfig (/Users/howardj/sites/doiuse/node_modules/browserslist/node.js:165:37)
    at browserslist (/Users/howardj/sites/doiuse/node_modules/browserslist/index.js:188:31) {
  message: "ENOENT, no such file or directory '/Users/howardj/sites/doiuse/.browserslistrc'",
  code: 'ENOENT',
  errno: 34,
  path: '/Users/howardj/sites/doiuse/.browserslistrc'
}
npm ERR! Test failed.  See above for more details.
jimmybrawn commented 3 years ago

PR for failing build https://github.com/anandthakker/doiuse/pull/121

JackHowa commented 3 years ago

sweet thank you @jimmybrawn and @pkuczynski -- looks good!


 doiuse % npm audit

                       === npm audit security report ===                        

found 0 vulnerabilities
 in 389 scanned packages
jackhowa@Jacks-Mac-mini doiuse % 
pkuczynski commented 3 years ago

You welcome @JackHowa :)