search

intoli / antd-scss-theme-plugin

A Webpack plugin for customizing Ant Design with an SCSS theme file and using Ant Design's compiled variables in SCSS files throughout your project.
https://intoli.com/blog/antd-scss-theme-plugin/
Other
202 stars 80 forks source link

moderate severity vulnerabilities in 'hoek' package #50

Open hfknight opened 5 years ago

hfknight commented 5 years ago

There are 4 moderate vulnerabilities after installing this plugin

Moderate Prototype pollution

Package hoek

Patched in > 4.2.0 < 5.0.0 || >= 5.0.3

Dependency of antd-scss-theme-plugin [dev]

Path antd-scss-theme-plugin > less > request > hawk > boom > hoek

More info https://nodesecurity.io/advisories/566

Moderate Prototype pollution

Package hoek

Patched in > 4.2.0 < 5.0.0 || >= 5.0.3

Dependency of antd-scss-theme-plugin [dev]

Path antd-scss-theme-plugin > less > request > hawk > cryptiles > boom > hoek

More info https://nodesecurity.io/advisories/566

Moderate Prototype pollution

Package hoek

Patched in > 4.2.0 < 5.0.0 || >= 5.0.3

Dependency of antd-scss-theme-plugin [dev]

Path antd-scss-theme-plugin > less > request > hawk > hoek

More info https://nodesecurity.io/advisories/566

Moderate Prototype pollution

Package hoek

Patched in > 4.2.0 < 5.0.0 || >= 5.0.3

Dependency of antd-scss-theme-plugin [dev]

Path antd-scss-theme-plugin > less > request > hawk > sntp > hoek

More info https://nodesecurity.io/advisories/566

found 4 moderate severity vulnerabilities in 16528 scanned packages 4 vulnerabilities require manual review. See the full report for details.

Can you fix it? Thanks!

bryanlarsen commented 5 years ago

More information from yarn install:

warning antd-scss-theme-plugin > less > request > hawk@3.1.3: This module moved to @hapi/hawk. Please make sure to switch over as this distribution is no longer supported and may contain bugs and critical security issues.
warning antd-scss-theme-plugin > less > request > hawk > cryptiles@2.0.5: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
warning antd-scss-theme-plugin > less > request > hawk > sntp@1.0.9: This module moved to @hapi/sntp. Please make sure to switch over as this distribution is no longer supported and may contain bugs and critical security issues.
warning antd-scss-theme-plugin > less > request > hawk > hoek@2.16.3: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
warning antd-scss-theme-plugin > less > request > hawk > sntp > hoek@2.16.3: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
warning antd-scss-theme-plugin > less > request > hawk > boom@2.10.1: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
warning antd-scss-theme-plugin > less > request > hawk > cryptiles > boom@2.10.1: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
warning antd-scss-theme-plugin > less > request > hawk > boom > hoek@2.16.3: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
bryanlarsen commented 5 years ago

I'm not sure how I unassigned @prncc, definitely didn't mean to do that...

jufemaiz commented 4 years ago

@bryanlarsen I'm not seeing that with npm audit – only hoek as above:

# npm audit

                       === npm audit security report ===

                                 Manual Review
             Some vulnerabilities require your attention to resolve

          Visit https://go.npm.me/audit-guide for additional guidance

  Moderate        Prototype Pollution

  Package         hoek

  Patched in      > 4.2.0 < 5.0.0 || >= 5.0.3

  Dependency of   antd-scss-theme-plugin [dev]

  Path            antd-scss-theme-plugin > less > request > hawk > boom > hoek

  More info       https://npmjs.com/advisories/566

  Moderate        Prototype Pollution

  Package         hoek

  Patched in      > 4.2.0 < 5.0.0 || >= 5.0.3

  Dependency of   antd-scss-theme-plugin [dev]

  Path            antd-scss-theme-plugin > less > request > hawk > cryptiles >
                  boom > hoek

  More info       https://npmjs.com/advisories/566

  Moderate        Prototype Pollution

  Package         hoek

  Patched in      > 4.2.0 < 5.0.0 || >= 5.0.3

  Dependency of   antd-scss-theme-plugin [dev]

  Path            antd-scss-theme-plugin > less > request > hawk > hoek

  More info       https://npmjs.com/advisories/566

  Moderate        Prototype Pollution

  Package         hoek

  Patched in      > 4.2.0 < 5.0.0 || >= 5.0.3

  Dependency of   antd-scss-theme-plugin [dev]

  Path            antd-scss-theme-plugin > less > request > hawk > sntp > hoek

  More info       https://npmjs.com/advisories/566

found 4 moderate severity vulnerabilities in 14342 scanned packages
  4 vulnerabilities require manual review. See the full report for details.
jufemaiz commented 4 years ago

less is now a major release behind.

Edit: