Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Failing NPM audit for @cypress/grep #25336

Closed
rojalbati-cf opened this issue Jan 3, 2023 · 2 comments
Closed

Failing NPM audit for @cypress/grep #25336

rojalbati-cf opened this issue Jan 3, 2023 · 2 comments
Labels
type: security 🔐 Security related

Comments

@rojalbati-cf
Copy link

rojalbati-cf commented Jan 3, 2023

Current behavior

This package is failing a npm audit at ^3.1.3. A dependency relies on got <11.8.5. See https://www.npmjs.com/advisories/1080920.
image

Desired behavior

No response

Test code to reproduce

image

Cypress Version

12.2.0

Node version

v16.18.1

Operating System

macOS 13.1 (22C65)

Debug Logs

# npm audit report

got  <11.8.5
Severity: moderate
Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97
No fix available
node_modules/got
  package-json  <=6.5.0
  Depends on vulnerable versions of got
  node_modules/package-json
    latest-version  0.2.0 - 5.1.0
    Depends on vulnerable versions of package-json
    node_modules/latest-version
      update-notifier  0.2.0 - 5.1.0
      Depends on vulnerable versions of latest-version
      node_modules/update-notifier
        simple-bin-help  >=1.3.0
        Depends on vulnerable versions of update-notifier
        node_modules/simple-bin-help
          find-test-names  >=1.1.0
          Depends on vulnerable versions of simple-bin-help
          node_modules/find-test-names
            @cypress/grep  *
            Depends on vulnerable versions of find-test-names
            node_modules/@cypress/grep

7 moderate severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.


### Other

_No response_
@rojalbati-cf
Copy link
Author

@emilyrohrbough are we fixing it anytime soon ?

@rojalbati-cf
Copy link
Author

Seems like it was fixed in this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type: security 🔐 Security related
Projects
None yet
Development

No branches or pull requests

3 participants