search

biojs / organisation

A hub for organising the community and ourselves
2 stars 1 forks source link

security vulnerability: hoek #33

Closed rowlandm closed 6 years ago

rowlandm commented 6 years ago

rowlandm, We found a potential security vulnerability in a repository for which you have been granted security alert access.

@biojs biojs/workman Known moderate severity security vulnerability detected in hoek < 5.0.3 defined in package-lock.json. package-lock.json update suggested: hoek ~> 5.0.3. Always verify the validity and compatibility of suggestions with your codebase.

http://sgmail.githubmail.com/wf/click?upn=lYxq-2FYU7yocrdKNILYalBk4GGCpJpQbsT7rGqxa4GoePDsb5km9onrdyWYTuMooFoJY2aehtg8bvj-2BFaLGcWxw-3D-3D_cFpE6haqMhGClj-2FqqmurXTm3AuO0EWrfQAO5JIFV0-2BhPoOHVAGTKxHD604gaCVysZfpxhJH0N-2FJYD74npykpdIkDdObXaChtyWp-2Ba48h3qJsSCJi11wjZaXJExXdS-2Ff-2F4u7OP-2BKhX-2BoCcMqTOiSH-2FHNsmuYxtM47rjfu5C7-2FDbAgcO5mEGkVonj5NAjFp9Rf63OFb79LcSbSYa-2FeG295tE3aiRJqKrJkZUusymsbkpeukrjUlmx5DT6Dlh4SG3LSrQQvk3FgNBH82X5iFZrI6g-3D-3D

DennisSchwartz commented 6 years ago

I got the same message. Seeing as we'll be replacing the workman in the next few months I think we can probably ignore this for now. But if you think we should take care of it, I might be able to have a look on the weekend.

yochannah commented 6 years ago

Given that the workman server doesn't actually store any personal data or take any inputs, I assume the worst-case scenario is that the website might be defaced or changed in some way? If that's true it seems like a low concern to me.

On 27 April 2018 at 09:45, Dennis Schwartz notifications@github.com wrote:

I got the same message. Seeing as we'll be replacing the workman in the next few months I think we can probably ignore this for now. But if you think we should take care of it, I might be able to have a look on the weekend.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/biojs/organisation/issues/33#issuecomment-384906917, or mute the thread https://github.com/notifications/unsubscribe-auth/AI14jr1Atn7a8GVK8RebeCIRfXCu1VNSks5tstqwgaJpZM4TpS8i .

DennisSchwartz commented 6 years ago

Yep. Plus it's now running in a docker container on our own server. We can always just restart it or move it.

rowlandm commented 6 years ago

Agreed. Lets skip this

El vie., 27 de abr. de 2018 18:53, Yo Yehudi notifications@github.com escribió:

Given that the workman server doesn't actually store any personal data or take any inputs, I assume the worst-case scenario is that the website might be defaced or changed in some way? If that's true it seems like a low concern to me.

On 27 April 2018 at 09:45, Dennis Schwartz notifications@github.com wrote:

I got the same message. Seeing as we'll be replacing the workman in the next few months I think we can probably ignore this for now. But if you think we should take care of it, I might be able to have a look on the weekend.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <https://github.com/biojs/organisation/issues/33#issuecomment-384906917 , or mute the thread < https://github.com/notifications/unsubscribe-auth/AI14jr1Atn7a8GVK8RebeCIRfXCu1VNSks5tstqwgaJpZM4TpS8i

.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/biojs/organisation/issues/33#issuecomment-384908859, or mute the thread https://github.com/notifications/unsubscribe-auth/AAZo0gfJOlfgqXML2fqCO9vTOMxhJvPrks5tstydgaJpZM4TpS8i .