nextcloud / firstrunwizard

🔮 The first impression matters. The firstrunwizard is the first Nextcloud impression.

45 stars 47 forks source link

[stable27] Fix npm audit #1301

Closed nextcloud-command closed 4 months ago

nextcloud-command commented 4 months ago

Audit report

This audit fix resolves 4 of the total 6 vulnerabilities found in your project.

Updated dependencies

@vue/component-compiler-utils
fast-xml-parser
postcss
vue-loader
Fixed vulnerabilities

@vue/component-compiler-utils #

Caused by vulnerable dependency:
- postcss
Affected versions: *
Package usage:
- node_modules/@vue/component-compiler-utils

fast-xml-parser #

fast-xml-parser vulnerable to ReDOS at currency parsing
Severity: high (CVSS 7.5)
Reference: https://github.com/advisories/GHSA-mpg4-rc92-vx8v
Affected versions: <4.4.1
Package usage:
- node_modules/fast-xml-parser

postcss #

PostCSS line return parsing error
Severity: moderate (CVSS 5.3)
Reference: https://github.com/advisories/GHSA-7fh5-64p2-3v2j
Affected versions: <8.4.31
Package usage:
- node_modules/@vue/component-compiler-utils/node_modules/postcss

vue-loader #

Caused by vulnerable dependency:
- @vue/component-compiler-utils
Affected versions: 15.0.0-beta.1 - 15.11.1
Package usage:
- node_modules/vue-loader