finos / git-proxy

Deploy custom push protections and policies on top of Git
https://git-proxy.finos.org
Apache License 2.0
110 stars 72 forks source link

chore: run npm audit fix #637

Closed JamieSlome closed 3 months ago

JamieSlome commented 3 months ago

Updates from npm audit fix command 👍

netlify[bot] commented 3 months ago

Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Name Link
Latest commit 35a64c451d264307892b4dc7aad1fb5d468b4fcf
Latest deploy log https://app.netlify.com/sites/endearing-brigadeiros-63f9d0/deploys/6687f6bff2781500081d3248
github-actions[bot] commented 3 months ago

Dependency Review

The following issues were found:

See the Details below.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/braces 3.0.2 :green_circle: 5.5
Details
CheckScoreReason
Code-Review:warning: 2Found 4/17 approved changesets -- score normalized to 2
Maintained:green_circle: 109 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
License:green_circle: 10license file detected
Dangerous-Workflow:warning: -1no workflows found
Packaging:warning: -1packaging workflow not detected
Binary-Artifacts:green_circle: 10no binaries found in the repo
Pinned-Dependencies:warning: -1no dependencies found
Token-Permissions:warning: -1No tokens found
Branch-Protection:warning: 0branch protection not enabled on development/release branches
Signed-Releases:warning: -1no releases found
Fuzzing:warning: 0project is not fuzzed
Vulnerabilities:green_circle: 100 existing vulnerabilities detected
Security-Policy:green_circle: 10security policy file detected
SAST:warning: 0SAST tool is not run on all commits -- score normalized to 0
npm/ip 2.0.1 :green_circle: 3
Details
CheckScoreReason
Code-Review:warning: 0Found 2/30 approved changesets -- score normalized to 0
Maintained:warning: 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Binary-Artifacts:green_circle: 10no binaries found in the repo
License:warning: 0license file not detected
Packaging:warning: -1packaging workflow not detected
Pinned-Dependencies:green_circle: 3dependency not pinned by hash detected -- score normalized to 3
Token-Permissions:warning: 0detected GitHub workflow tokens with excessive permissions
Branch-Protection:warning: 0branch protection not enabled on development/release branches
Fuzzing:warning: 0project is not fuzzed
Signed-Releases:warning: -1no releases found
Security-Policy:warning: 0security policy file not detected
SAST:warning: 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities:green_circle: 73 existing vulnerabilities detected
npm/braces 3.0.3 :green_circle: 5.5
Details
CheckScoreReason
Code-Review:warning: 2Found 4/17 approved changesets -- score normalized to 2
Maintained:green_circle: 109 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
License:green_circle: 10license file detected
Dangerous-Workflow:warning: -1no workflows found
Packaging:warning: -1packaging workflow not detected
Binary-Artifacts:green_circle: 10no binaries found in the repo
Pinned-Dependencies:warning: -1no dependencies found
Token-Permissions:warning: -1No tokens found
Branch-Protection:warning: 0branch protection not enabled on development/release branches
Signed-Releases:warning: -1no releases found
Fuzzing:warning: 0project is not fuzzed
Vulnerabilities:green_circle: 100 existing vulnerabilities detected
Security-Policy:green_circle: 10security policy file detected
SAST:warning: 0SAST tool is not run on all commits -- score normalized to 0
npm/fill-range 7.1.1 :green_circle: 4.2
Details
CheckScoreReason
Maintained:warning: 23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Code-Review:warning: 1Found 4/30 approved changesets -- score normalized to 1
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
License:green_circle: 10license file detected
Pinned-Dependencies:warning: 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection:warning: 0branch protection not enabled on development/release branches
Packaging:warning: -1packaging workflow not detected
Binary-Artifacts:green_circle: 10no binaries found in the repo
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Token-Permissions:warning: 0detected GitHub workflow tokens with excessive permissions
Signed-Releases:warning: -1no releases found
Fuzzing:warning: 0project is not fuzzed
Vulnerabilities:green_circle: 100 existing vulnerabilities detected
Security-Policy:warning: 0security policy file not detected
SAST:green_circle: 7SAST tool detected but not run on all commits
npm/ip-address 9.0.5 :green_circle: 3.2
Details
CheckScoreReason
Code-Review:warning: 0Found 1/28 approved changesets -- score normalized to 0
Maintained:warning: 01 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
License:green_circle: 10license file detected
Signed-Releases:warning: -1no releases found
Packaging:warning: -1packaging workflow not detected
Pinned-Dependencies:warning: -1no dependencies found
Binary-Artifacts:green_circle: 10no binaries found in the repo
Token-Permissions:warning: -1No tokens found
Dangerous-Workflow:warning: -1no workflows found
Branch-Protection:warning: -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Fuzzing:warning: 0project is not fuzzed
Security-Policy:warning: 0security policy file not detected
SAST:warning: 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities:green_circle: 82 existing vulnerabilities detected
npm/jsbn 1.1.0 :green_circle: 3.1
Details
CheckScoreReason
Code-Review:green_circle: 4Found 10/24 approved changesets -- score normalized to 4
Maintained:warning: 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
License:green_circle: 9license file detected
Token-Permissions:warning: -1No tokens found
Binary-Artifacts:green_circle: 10no binaries found in the repo
Packaging:warning: -1packaging workflow not detected
Dangerous-Workflow:warning: -1no workflows found
Pinned-Dependencies:warning: -1no dependencies found
Branch-Protection:warning: 0branch protection not enabled on development/release branches
Signed-Releases:warning: -1no releases found
Fuzzing:warning: 0project is not fuzzed
Security-Policy:warning: 0security policy file not detected
Vulnerabilities:green_circle: 73 existing vulnerabilities detected
SAST:warning: 0SAST tool is not run on all commits -- score normalized to 0
npm/socks 2.8.3 :green_circle: 4.2
Details
CheckScoreReason
Maintained:green_circle: 52 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 5
Code-Review:warning: 2Found 8/30 approved changesets -- score normalized to 2
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
License:green_circle: 10license file detected
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Packaging:warning: -1packaging workflow not detected
Binary-Artifacts:green_circle: 10no binaries found in the repo
Token-Permissions:warning: 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies:green_circle: 3dependency not pinned by hash detected -- score normalized to 3
Branch-Protection:warning: 0branch protection not enabled on development/release branches
Fuzzing:warning: 0project is not fuzzed
Signed-Releases:warning: -1no releases found
Security-Policy:warning: 0security policy file not detected
SAST:warning: 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities:green_circle: 91 existing vulnerabilities detected
npm/sprintf-js 1.1.3 :warning: 2.1
Details
CheckScoreReason
Code-Review:green_circle: 3Found 5/14 approved changesets -- score normalized to 3
Maintained:warning: 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
License:green_circle: 10license file detected
Dangerous-Workflow:warning: -1no workflows found
Token-Permissions:warning: -1No tokens found
Packaging:warning: -1packaging workflow not detected
Binary-Artifacts:green_circle: 10no binaries found in the repo
Pinned-Dependencies:warning: -1no dependencies found
Signed-Releases:warning: -1no releases found
Branch-Protection:warning: 0branch protection not enabled on development/release branches
Fuzzing:warning: 0project is not fuzzed
Security-Policy:warning: 0security policy file not detected
SAST:warning: 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities:warning: 028 existing vulnerabilities detected
npm/fill-range 7.0.1 :green_circle: 4.2
Details
CheckScoreReason
Maintained:warning: 23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Code-Review:warning: 1Found 4/30 approved changesets -- score normalized to 1
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
License:green_circle: 10license file detected
Pinned-Dependencies:warning: 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection:warning: 0branch protection not enabled on development/release branches
Packaging:warning: -1packaging workflow not detected
Binary-Artifacts:green_circle: 10no binaries found in the repo
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Token-Permissions:warning: 0detected GitHub workflow tokens with excessive permissions
Signed-Releases:warning: -1no releases found
Fuzzing:warning: 0project is not fuzzed
Vulnerabilities:green_circle: 100 existing vulnerabilities detected
Security-Policy:warning: 0security policy file not detected
SAST:green_circle: 7SAST tool detected but not run on all commits
npm/socks 2.7.1 :green_circle: 4.2
Details
CheckScoreReason
Maintained:green_circle: 52 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 5
Code-Review:warning: 2Found 8/30 approved changesets -- score normalized to 2
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
License:green_circle: 10license file detected
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Packaging:warning: -1packaging workflow not detected
Binary-Artifacts:green_circle: 10no binaries found in the repo
Token-Permissions:warning: 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies:green_circle: 3dependency not pinned by hash detected -- score normalized to 3
Branch-Protection:warning: 0branch protection not enabled on development/release branches
Fuzzing:warning: 0project is not fuzzed
Signed-Releases:warning: -1no releases found
Security-Policy:warning: 0security policy file not detected
SAST:warning: 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities:green_circle: 91 existing vulnerabilities detected

Scanned Manifest Files

package-lock.json
  • braces@3.0.2
  • ip@2.0.1
  • braces@3.0.3
  • fill-range@7.1.1
  • ip-address@9.0.5
  • jsbn@1.1.0
  • socks@2.8.3
  • sprintf-js@1.1.3
  • fill-range@7.0.1
  • socks@2.7.1
codecov[bot] commented 3 months ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 57.39%. Comparing base (87d586a) to head (35a64c4).

Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #637 +/- ## ======================================= Coverage 57.39% 57.39% ======================================= Files 46 46 Lines 1582 1582 ======================================= Hits 908 908 Misses 674 674 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.