search

anvaka / sayit

Visualization of related subreddits
https://anvaka.github.io/sayit
MIT License
1.28k stars 108 forks source link

npm found 2 vulnerabilities (1 moderate, 1 high) #5

Closed micahstubbs closed 3 years ago

micahstubbs commented 5 years ago

thanks for the fantastic tool. tried to run it myself locally, and thought I should share the warnings that latest LTS node + npm showed me:

screen shot 2019-01-21 at 1 01 42 pm

npm audit text added 1231 packages from 684 contributors and audited 10704 packages in 11.154s found 2 vulnerabilities (1 moderate, 1 high) run `npm audit fix` to fix them, or `npm audit` for details ➜ sayit git:(master) npm audit === npm audit security report === # Run npm install --save-dev webpack-dev-server@3.1.14 to resolve 1 vulnerability SEMVER WARNING: Recommended action is a potentially breaking change ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ High │ Missing Origin Validation │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ webpack-dev-server │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ webpack-dev-server [dev] │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ webpack-dev-server │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://nodesecurity.io/advisories/725 │ └───────────────┴──────────────────────────────────────────────────────────────┘ # Run npm install --save-dev url-loader@1.1.2 to resolve 1 vulnerability SEMVER WARNING: Recommended action is a potentially breaking change ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ Moderate │ Regular Expression Denial of Service │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ mime │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ url-loader [dev] │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ url-loader > mime │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://nodesecurity.io/advisories/535 │ └───────────────┴──────────────────────────────────────────────────────────────┘ found 2 vulnerabilities (1 moderate, 1 high) in 10704 scanned packages 2 vulnerabilities require semver-major dependency updates.
micahstubbs commented 5 years ago

looks like a related problem https://github.com/webpack/webpack-dev-server/issues/1334

anvaka commented 3 years ago

I have just updated all the dependencies to the latest. Should be resolved now