swimlane / ngx-dnd

🕶 Drag, Drop and Sorting Library for Angular2 and beyond!
https://swimlane.github.io/ngx-dnd/
MIT License
575 stars 135 forks source link

SPT-11504 Upgrade vulnerable NPM packages in ngx-dnd #208

Closed ischultz closed 2 years ago

ischultz commented 2 years ago

What kind of change does this PR introduce? (check one with "x")

What is the current behavior? (You can also link to an open issue here) Vulnerable NPM packages

What is the new behavior? Less vulnerable NPM packages, updated to Angular v13, converted to use ESLint

Does this PR introduce a breaking change? (check one with "x")

If this PR contains a breaking change, please describe the impact and migration path for existing applications: ...

Angular was updated from version 11 to 13 in this PR which is likely to be considered as a breaking change.

Other information:

NPM audit results

The following is a production NPM audit that was performed after applying the updates in this PR. Audit results for dev dependencies are not included.

Found 1 vulnerabilities within 275 dependencies.

Critical High Moderate Low Info
0 1 0 0 0

Known vulnerabilities:

Name Package name Severity CVEs Recommendation
Regular Expression Denial of Service in trim trim high CWE-400, CVE-2020-7753 Upgrade to version 0.0.3 or later

Recommended actions:

Package Action Target version Major update What to do
trim review Manual review