Code Inspection: npm audit on deploy-command

cdupuis commented 5 years ago

fstream:<1.0.12

(error) Arbitrary File Overwrite Upgrade to version 1.0.12 or later.
- fstream:1.0.11:
- @atomist/sdm-core>npm>libcipm>npm-lifecycle>node-gyp>fstream
- @atomist/sdm-core>npm>libcipm>npm-lifecycle>node-gyp>tar>fstream
- @atomist/sdm-core>npm>libnpm>npm-lifecycle>node-gyp>fstream
- @atomist/sdm-core>npm>libnpm>npm-lifecycle>node-gyp>tar>fstream
- @atomist/sdm-core>npm>node-gyp>fstream
- @atomist/sdm-core>npm>node-gyp>tar>fstream
- @atomist/sdm-core>npm>npm-lifecycle>node-gyp>fstream
- @atomist/sdm-core>npm>npm-lifecycle>node-gyp>tar>fstream

graphql-code-generator:>=0

(error) Insecure Default Configuration No fix is currently available. Consider using an alternative module until a fix is made available.
- graphql-code-generator:0.16.1:
- @atomist/automation-client>graphql-code-generator

handlebars:<=4.0.13 || >=4.1.0 <4.1.2

(error) Prototype Pollution For handlebars 4.1.x upgrade to 4.1.2 or later. For handlebars 4.0.x upgrade to 4.0.14 or later.
- handlebars:4.1.0:
- @atomist/sdm-local>express-handlebars>handlebars
- typedoc>@types/handlebars>handlebars
- typedoc>handlebars

js-yaml:<3.13.0

(warn) Denial of Service Upgrade to version 3.13.0.
- js-yaml:3.12.1:
- @atomist/automation-client>graphql-code-generator>js-yaml
- js-yaml:3.12.0:
- mocha>js-yaml

js-yaml:<3.13.1

(error) Code Injection Upgrade to version 3.13.1.
- js-yaml:3.12.1:
- @atomist/automation-client>graphql-code-generator>js-yaml
- js-yaml:3.12.0:
- mocha>js-yaml

marked:>=0.3.14 <0.6.2

(warn) Regular Expression Denial of Service Upgrade to version 0.6.2 or later.
- marked:0.4.0:
- typedoc>marked

tar:<2.2.2 || >=3.0.0 <4.4.2

(error) Arbitrary File Overwrite For tar 4.x, upgrade to version 4.4.2 or later. For tar 2.x, upgrade to version 2.2.2 or later.
- tar:2.2.1:
- @atomist/sdm-core>npm>libcipm>npm-lifecycle>node-gyp>tar
- @atomist/sdm-core>npm>libnpm>npm-lifecycle>node-gyp>tar
- @atomist/sdm-core>npm>node-gyp>tar
- @atomist/sdm-core>npm>npm-lifecycle>node-gyp>tar

[atomist:code-inspection:deploy-command=@atomist/atomist-sdm]

atomist[bot] commented 4 years ago

Thanks for your contribution!

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

atomist[bot] commented 3 years ago

Thanks for your contribution!

This issue has been automatically marked with stale because it has not had any activity in last 50 days. It will be closed in 7 days if no further activity occurs. To prevent closing, label with defer or blocked or any of the changelog: labels.

atomist / cli