Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

frontend: update npm dependencies (npm audit fix) #2056

Merged
merged 1 commit into from
Dec 20, 2023

Conversation

nodiscc
Copy link
Member

@nodiscc nodiscc commented Dec 5, 2023

yarn.lock (yarn)
================
Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 1, CRITICAL: 0)

┌─────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────┐
│   Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                         Title                         │
├─────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────┤
│ glob-parent │ CVE-2020-28469 │ HIGH     │ fixed  │ 3.1.0             │ 5.1.2         │ Regular expression denial of service                  │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2020-28469            │
├─────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼───────────────────────────────────────────────────────┤
│ postcss     │ CVE-2023-44270 │ MEDIUM   │        │ 7.0.39            │ 8.4.31        │ An issue was discovered in PostCSS before 8.4.31. The │
│             │                │          │        │                   │               │ vulnerability af ......                               │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-44270            │
└─────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────┘
  • Remaining warnings must be addressed with npm audit fix --force which has more potential for breakage

@nodiscc nodiscc added security dependencies Pull requests that update a dependency file labels Dec 5, 2023
@nodiscc nodiscc added this to the 0.14.0 milestone Dec 5, 2023
@nodiscc nodiscc merged commit 5512938 into shaarli:master Dec 20, 2023
8 checks passed
@nodiscc nodiscc deleted the npm-audit-fix branch December 20, 2023 11:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file security
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant