hashicorp / vscode-hcl

HCL (HashiCorp Configuration Language) Extension for Visual Studio Code
https://marketplace.visualstudio.com/items?itemName=HashiCorp.HCL
Mozilla Public License 2.0
49 stars 10 forks source link

Bump dependencies through `npm audit fix` #323

Closed dbanck closed 1 month ago

dbanck commented 1 month ago

This PR bumps 5 dependencies reported by npm audit

❯ npm audit
# npm audit report

@azure/identity  <4.2.1
Severity: moderate
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability - https://github.com/advisories/GHSA-m5vv-6r4h-3vj9
fix available via `npm audit fix`
node_modules/@azure/identity

@azure/msal-node  2.7.0 - 2.9.1
Severity: moderate
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability - https://github.com/advisories/GHSA-m5vv-6r4h-3vj9
fix available via `npm audit fix`
node_modules/@azure/msal-node

braces  <3.0.3
Severity: high
Uncontrolled resource consumption in braces - https://github.com/advisories/GHSA-grv7-fg5c-xmjg
fix available via `npm audit fix`
node_modules/braces

micromatch  <4.0.8
Severity: moderate
Regular Expression Denial of Service (ReDoS) in micromatch - https://github.com/advisories/GHSA-952p-6rrq-rcjv
fix available via `npm audit fix`
node_modules/micromatch

webpack  5.0.0-alpha.0 - 5.93.0
Severity: moderate
Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS - https://github.com/advisories/GHSA-4vvj-4cpr-p986
fix available via `npm audit fix`
node_modules/webpack

5 vulnerabilities (4 moderate, 1 high)

These reported vulnerabilities should have no impact on end users.