Code Inspection: npm audit on converge - Githubissues

atomist / sdm-pack-fingerprint

Atomist software delivery machine (SDM) extension pack providing fingerprinting support.

Apache License 2.0

1 stars 1 forks source link

Code Inspection: npm audit on converge #65

Closed cdupuis closed 5 years ago

cdupuis commented 5 years ago

fstream:<1.0.12

(error) Arbitrary File Overwrite Upgrade to version 1.0.12 or later.
- fstream:1.0.11:
- @atomist/sdm-core>npm>libcipm>npm-lifecycle>node-gyp>fstream
- @atomist/sdm-core>npm>libcipm>npm-lifecycle>node-gyp>tar>fstream
- @atomist/sdm-core>npm>libnpm>npm-lifecycle>node-gyp>fstream
- @atomist/sdm-core>npm>libnpm>npm-lifecycle>node-gyp>tar>fstream
- @atomist/sdm-core>npm>node-gyp>fstream
- @atomist/sdm-core>npm>node-gyp>tar>fstream
- @atomist/sdm-core>npm>npm-lifecycle>node-gyp>fstream
- @atomist/sdm-core>npm>npm-lifecycle>node-gyp>tar>fstream

graphql-code-generator:>=0

(error) Insecure Default Configuration No fix is currently available. Consider using an alternative module until a fix is made available.
- graphql-code-generator:0.16.1:
- @atomist/automation-client>graphql-code-generator

handlebars:<=4.0.13 || >=4.1.0 <4.1.2

(error) Prototype Pollution For handlebars 4.1.x upgrade to 4.1.2 or later. For handlebars 4.0.x upgrade to 4.0.14 or later.
- handlebars:4.1.1:
- typedoc>handlebars

js-yaml:<3.13.0

(warn) Denial of Service Upgrade to version 3.13.0.
- js-yaml:3.12.1:
- @atomist/automation-client>graphql-code-generator>js-yaml

js-yaml:<3.13.1

(error) Code Injection Upgrade to version 3.13.1.
- js-yaml:3.13.0:
- @atomist/automation-client>apollo>apollo-codegen-core>apollo-language-server>cosmiconfig>js-yaml
- @atomist/automation-client>apollo>apollo-codegen-flow>apollo-codegen-core>apollo-language-server>cosmiconfig>js-yaml
- @atomist/automation-client>apollo>apollo-codegen-scala>apollo-codegen-core>apollo-language-server>cosmiconfig>js-yaml
- @atomist/automation-client>apollo>apollo-codegen-swift>apollo-codegen-core>apollo-language-server>cosmiconfig>js-yaml
- @atomist/automation-client>apollo>apollo-codegen-typescript>apollo-codegen-core>apollo-language-server>cosmiconfig>js-yaml
- @atomist/automation-client>apollo>apollo-language-server>cosmiconfig>js-yaml
- @atomist/automation-client>graphql-code-generator>graphql-config>js-yaml
- @atomist/sdm-core>@kubernetes/client-node>js-yaml
- apollo-codegen>graphql-config>js-yaml
- tslint>js-yaml
- js-yaml:3.12.1:
- @atomist/automation-client>graphql-code-generator>js-yaml

marked:>=0.3.14 <0.6.2

(warn) Regular Expression Denial of Service Upgrade to version 0.6.2 or later.
- marked:0.3.19:
- typedoc>marked

tar:<2.2.2 || >=3.0.0 <4.4.2

(error) Arbitrary File Overwrite For tar 4.x, upgrade to version 4.4.2 or later. For tar 2.x, upgrade to version 2.2.2 or later.
- tar:2.2.1:
- @atomist/sdm-core>npm>libcipm>npm-lifecycle>node-gyp>tar
- @atomist/sdm-core>npm>libnpm>npm-lifecycle>node-gyp>tar
- @atomist/sdm-core>npm>node-gyp>tar
- @atomist/sdm-core>npm>npm-lifecycle>node-gyp>tar

[atomist:code-inspection:converge=@atomist/atomist-sdm]

cdupuis commented 5 years ago

Issue closed because last code inspection problem was fixed by @atomist-bot when they pushed 586e9e0.