search

nrwl / nx

Smart Monorepos · Fast CI
https://nx.dev
MIT License
23.47k stars 2.33k forks source link

Vulnerability detected: Prototype pollution #4507

Closed OysteinAmundsen closed 3 years ago

OysteinAmundsen commented 3 years ago

https://snyk.io/test/npm/@nrwl/angular/11.1.2

Vulnerability exists in cache-base@1.0.1 indirectly used by @nrwl/cypress@11.1.2 through dependencies.

FIX: Upgrade dependencies @nrwl/cypress depends on severely outdated versions of ts-loader and fork-ts-checker-webpack-plugin.

mehrad-rafigh commented 3 years ago

There is an issue for fork-ts-checker-webpack-plugin #4494 Unfortunately there are a ton of breaking changes, like dropped support of constants nx relies on and much more.

ultd commented 3 years ago

I too am getting this vulnerability in our code security/analysis tool. I think this needs to be a top priority as our stack using angular and react uses @nrwl/cypress for testing (as do all nx e2e tests generated). Not to mention #4494 as well. This is making our development life very hard as our CI/CD pipelines reject merge requests on high severity vulnerabilities and our minikube development environment consistently needs to be restarted due to the buggy/outdated version of fork-ts-checker-webpack-plugin

github-actions[bot] commented 3 years ago

This issue has been automatically marked as stale because it hasn't had any recent activity. It will be closed in 14 days if no further activity occurs. If we missed this issue please reply to keep it active. Thanks for being a part of the Nx community! 🙏

github-actions[bot] commented 1 year ago

This issue has been closed for more than 30 days. If this issue is still occuring, please open a new issue with more recent context.