Skip to content

chore(package): update dependencies to fix vulnerabilities - #45

Merged
mister-ben merged 1 commit into
videojs:mainfrom
thomasjammet:main
Apr 22, 2024
Merged

chore(package): update dependencies to fix vulnerabilities#45
mister-ben merged 1 commit into
videojs:mainfrom
thomasjammet:main

Conversation

@thomasjammet

Copy link
Copy Markdown
Contributor

Current version of videojs/videojs-generate-karma-config has critical npm vulnerabilities :

# npm audit report

ansi-regex  5.0.0
Severity: high
Inefficient Regular Expression Complexity in chalk/ansi-regex - https://github.com/advisories/GHSA-93q8-gq69-wqmw
fix available via `npm audit fix`
node_modules/ansi-regex

debug  3.2.0 - 3.2.6
Severity: moderate
Regular Expression Denial of Service in debug - https://github.com/advisories/GHSA-gxpj-cx7g-858c
fix available via `npm audit fix`
node_modules/debug

dot-prop  <4.2.1
Severity: high
dot-prop Prototype Pollution vulnerability - https://github.com/advisories/GHSA-ff7x-qrg7-qggm
fix available via `npm audit fix`
node_modules/conventional-changelog-videojs/node_modules/dot-prop
  compare-func  <=1.3.4
  Depends on vulnerable versions of dot-prop
  node_modules/conventional-changelog-videojs/node_modules/compare-func
    conventional-changelog-videojs  3.0.0
    Depends on vulnerable versions of compare-func
    node_modules/conventional-changelog-videojs

handlebars  <=4.7.6
Severity: critical
Remote code execution in handlebars when compiling templates - https://github.com/advisories/GHSA-f2jv-r9rf-7988
Prototype Pollution in handlebars - https://github.com/advisories/GHSA-765h-qjxv-5f44
fix available via `npm audit fix`
node_modules/handlebars

hosted-git-info  <2.8.9
Severity: moderate
Regular Expression Denial of Service in hosted-git-info - https://github.com/advisories/GHSA-43f8-2h32-f4cj
fix available via `npm audit fix`
node_modules/hosted-git-info

minimist  1.0.0 - 1.2.5
Severity: critical
Prototype Pollution in minimist - https://github.com/advisories/GHSA-xvch-5gv4-984h
fix available via `npm audit fix`
node_modules/minimist

path-parse  <1.0.7
Severity: moderate
Regular Expression Denial of Service in path-parse - https://github.com/advisories/GHSA-hj48-42vr-x3v9
fix available via `npm audit fix`
node_modules/path-parse

semver  <=5.7.1 || 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix`
node_modules/conventional-changelog-cli/node_modules/read-pkg/node_modules/semver
node_modules/conventional-changelog-cli/node_modules/semver
node_modules/conventional-changelog-core/node_modules/read-pkg/node_modules/semver
node_modules/conventional-changelog-core/node_modules/semver
node_modules/conventional-changelog-writer/node_modules/normalize-package-data/node_modules/semver
node_modules/conventional-changelog-writer/node_modules/read-pkg/node_modules/semver
node_modules/conventional-changelog-writer/node_modules/semver
node_modules/conventional-commits-parser/node_modules/read-pkg/node_modules/semver
node_modules/conventional-commits-parser/node_modules/semver
node_modules/eslint-plugin-jsdoc/node_modules/semver
node_modules/eslint/node_modules/semver
node_modules/git-raw-commits/node_modules/read-pkg/node_modules/semver
node_modules/git-raw-commits/node_modules/semver
node_modules/git-semver-tags/node_modules/normalize-package-data/node_modules/semver
node_modules/git-semver-tags/node_modules/read-pkg/node_modules/semver
node_modules/git-semver-tags/node_modules/semver
node_modules/semver

semver-regex  <=3.1.3
Severity: high
semver-regex Regular Expression Denial of Service (ReDOS) - https://github.com/advisories/GHSA-44c6-4v22-4mhx
Regular expression denial of service in semver-regex - https://github.com/advisories/GHSA-4x5v-gmq8-25ch
fix available via `npm audit fix`
node_modules/semver-regex

shell-quote  <=1.7.2
Severity: critical
Improper Neutralization of Special Elements used in a Command in Shell-quote - https://github.com/advisories/GHSA-g4rg-993r-mgx7
fix available via `npm audit fix`
node_modules/shell-quote

shelljs  <=0.8.4
Severity: high
Improper Privilege Management in shelljs - https://github.com/advisories/GHSA-64g7-mvw6-v9qj
Improper Privilege Management in shelljs - https://github.com/advisories/GHSA-4rq4-32rv-6wp6
fix available via `npm audit fix`
node_modules/shelljs

trim  <0.0.3
Severity: high
Regular Expression Denial of Service in trim - https://github.com/advisories/GHSA-w5p7-h5w8-2hfq
fix available via `npm audit fix`
node_modules/trim
  remark-parse  <=8.0.3
  Depends on vulnerable versions of trim
  node_modules/remark-parse
    @textlint/markdown-to-ast  6.0.8 - 6.3.5
    Depends on vulnerable versions of remark-parse
    node_modules/@textlint/markdown-to-ast
      doctoc  1.4.0 - 2.1.0
      Depends on vulnerable versions of @textlint/markdown-to-ast
      node_modules/doctoc

trim-newlines  <3.0.1
Severity: high
Uncontrolled Resource Consumption in trim-newlines - https://github.com/advisories/GHSA-7p7h-4mm5-852v
fix available via `npm audit fix`
node_modules/trim-newlines
  meow  3.4.0 - 5.0.0
  Depends on vulnerable versions of trim-newlines
  node_modules/meow

trim-off-newlines  <1.0.3
Severity: moderate
Uncontrolled Resource Consumption in trim-off-newlines - https://github.com/advisories/GHSA-38fc-wpqx-33j7
fix available via `npm audit fix`
node_modules/trim-off-newlines

underscore  1.3.2 - 1.12.0
Severity: critical
Arbitrary Code Execution in underscore - https://github.com/advisories/GHSA-cf4h-3jhx-xvhq
fix available via `npm audit fix`
node_modules/nomnom/node_modules/underscore
  nomnom  >=1.6.0
  Depends on vulnerable versions of underscore
  node_modules/nomnom

word-wrap  <1.2.4
Severity: moderate
word-wrap vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-j8xg-fqg3-53r7
fix available via `npm audit fix`
node_modules/word-wrap

23 vulnerabilities (6 moderate, 12 high, 5 critical)

This PR fixes all but it needs merge of other PRs before :

@mister-ben
mister-ben merged commit f248808 into videojs:main Apr 22, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants