search

linkeddata / dokieli

:bulb: dokieli is a clientside editor for decentralised article publishing, annotations and social interactions
https://dokie.li/
Other
803 stars 82 forks source link

Chore: override jsonld to fix vulnerability with request #351

Closed VirginiaBalseiro closed 1 year ago

VirginiaBalseiro commented 1 year ago

This PR fixes a vulnerability in request by overriding jsonld package to use version 5.0.0.

npm audit report with dependency tree FYI: 

request  *
Severity: moderate
Server-Side Request Forgery in Request - https://github.com/advisories/GHSA-p8p7-x288-28g6
fix available via `npm audit fix --force`
Will install rdf-store-ldp@0.1.2, which is a breaking change
node_modules/request
  jsonld  <=4.0.1
  Depends on vulnerable versions of request
  node_modules/jsonld
    rdf-parser-jsonld  *
    Depends on vulnerable versions of jsonld
    node_modules/rdf-parser-jsonld
      rdf-formats-common  *
      Depends on vulnerable versions of rdf-parser-jsonld
      node_modules/rdf-formats-common
        rdf-store-ldp  >=0.3.0-rc1
        Depends on vulnerable versions of rdf-formats-common
        node_modules/rdf-store-ldp
          simplerdf  >=0.2.6
          Depends on vulnerable versions of rdf-store-ldp
          node_modules/simplerdf