yeoman / generator

Rails-inspired generator system that provides scaffolding for your apps
http://yeoman.io
BSD 2-Clause "Simplified" License
1.21k stars 299 forks source link

Dependent library tui-jsdoc-template has high severity vulnerabilities #1455

Closed yangliuyu closed 1 year ago

yangliuyu commented 1 year ago

When I checkout the source code with tag v6.0.0-rc.0 and run npm install, got 4 high severity vulnerabilities

(base) ➜  generator git:(main) ✗ npm install

> yeoman-generator@6.0.0-rc.0 prepare
> npm run build

> yeoman-generator@6.0.0-rc.0 build
> tsc && npm run copy-types

> yeoman-generator@6.0.0-rc.0 copy-types
> cpy "src/**/*.d.(|c|m)ts" dist/

changed 104 packages, and audited 1221 packages in 13s

257 packages are looking for funding
  run `npm fund` for details

4 high severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.

Run `npm audit` for details.

Then I run npm audit, got

(base) ➜  generator git:(main) ✗ npm audit
# npm audit report

nth-check  <2.0.1
Severity: high
Inefficient Regular Expression Complexity in nth-check - https://github.com/advisories/GHSA-rp65-9cf3-cjxr
No fix available
node_modules/nth-check
  css-select  <=3.1.0
  Depends on vulnerable versions of nth-check
  node_modules/css-select
    cheerio  0.19.0 - 1.0.0-rc.3
    Depends on vulnerable versions of css-select
    node_modules/cheerio
      tui-jsdoc-template  *
      Depends on vulnerable versions of cheerio
      node_modules/tui-jsdoc-template

4 high severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.

Is there any possible to upgrade tui-jsdoc-template or replace it?

github-actions[bot] commented 1 year ago

This issue is stale because it has been open with no activity. Remove stale label or comment or this will be closed