apache / couchdb-fauxton

Fauxton is the new Web UI for CouchDB
https://github.com/apache/couchdb-fauxton
Apache License 2.0
373 stars 225 forks source link

Address vulnerabilities #1433

Closed fryjordan closed 3 months ago

fryjordan commented 3 months ago

Overview

Vulnerabilities were found in Fauxton dependencies. The changes in this PR resolve them (npm audit fix).

# npm audit report

express  <4.19.2
Severity: moderate
Express.js Open Redirect in malformed URLs - https://github.com/advisories/GHSA-rv95-896h-c2vc
fix available via `npm audit fix`
node_modules/express

follow-redirects  <=1.15.5
Severity: moderate
follow-redirects' Proxy-Authorization header kept across hosts - https://github.com/advisories/GHSA-cxjh-pqwp-8mfp
fix available via `npm audit fix`
node_modules/follow-redirects

lodash.pick  >=4.0.0
Severity: high
Prototype Pollution in lodash - https://github.com/advisories/GHSA-p6mc-m468-83gw
fix available via `npm audit fix`
node_modules/lodash.pick
  nightwatch  2.6.0 - 3.3.8
  Depends on vulnerable versions of lodash.pick
  node_modules/nightwatch

4 vulnerabilities (2 moderate, 2 high)

Testing recommendations

Checklist