Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update project npm dependencies to remove vulnerabilities #2518

Closed
KonstantinEpam23 opened this issue Apr 21, 2023 · 2 comments · Fixed by #3266
Closed

Update project npm dependencies to remove vulnerabilities #2518

KonstantinEpam23 opened this issue Apr 21, 2023 · 2 comments · Fixed by #3266

Comments

@KonstantinEpam23
Copy link
Collaborator

At the moment running npm audit shows 10 high severity vulnerabilities, these need to be fix in .

In general it is a good idea to keep dependencies updated for several reasons:

  • It can address known security vulnerabilities.
  • It can fix bugs and improve stability .
  • New versions of dependencies often come with performance improvements.
  • It can ensure that application remains compatible with other libraries and tools that we use.

Current npm audit output:

# npm audit report

minimatch  <3.0.5
Severity: high
minimatch ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3
fix available via `npm audit fix --force`
Will install serve@14.2.0, which is a breaking change
node_modules/serve-handler/node_modules/minimatch
  serve-handler  1.1.0 - 6.1.3
  Depends on vulnerable versions of minimatch
  node_modules/serve-handler
    serve  7.0.0 - 14.0.1
    Depends on vulnerable versions of serve-handler
    node_modules/serve

nth-check  <2.0.1
Severity: high
Inefficient Regular Expression Complexity in nth-check - https://github.com/advisories/GHSA-rp65-9cf3-cjxr
fix available via `npm audit fix --force`
Will install @svgr/rollup@7.0.0, which is a breaking change
node_modules/nth-check
  css-select  <=3.1.0
  Depends on vulnerable versions of nth-check
  node_modules/svgo/node_modules/css-select
    svgo  1.0.0 - 1.3.2
    Depends on vulnerable versions of css-select
    node_modules/svgo
      @svgr/plugin-svgo  <=5.5.0
      Depends on vulnerable versions of svgo
      node_modules/@svgr/plugin-svgo
        @svgr/rollup  4.0.0 - 5.5.0
        Depends on vulnerable versions of @svgr/plugin-svgo
        node_modules/@svgr/rollup
        @svgr/webpack  4.0.0 - 5.5.0
        Depends on vulnerable versions of @svgr/plugin-svgo
        node_modules/@svgr/webpack
          react-scripts  >=2.1.4
          Depends on vulnerable versions of @svgr/webpack
          node_modules/react-scripts

10 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force
@AlonNavon
Copy link

AlonNavon commented Aug 1, 2023

Hey @KonstantinEpam23,

We're part of a startup called Seal Security that mitigates software vulnerabilities in older open source versions by backporting/creating standalone security patches - enabling more straightforward remediation in cases like this. We created an nth-check 1.02-sp1 that's vulnerability-free. As with all of our patches, it's open-source and available for free.

If relevant, check out our GitHub repo if you wish to learn more, or start using our app.

Please feel free to reach us at info@seal.security if you have any requests/questions.

@chgayane chgayane assigned chgayane and unassigned KonstantinEpam23 Sep 5, 2023
chgayane pushed a commit that referenced this issue Sep 6, 2023
@chgayane chgayane linked a pull request Sep 6, 2023 that will close this issue
9 tasks
chgayane pushed a commit that referenced this issue Sep 11, 2023
chgayane pushed a commit that referenced this issue Sep 11, 2023
chgayane pushed a commit that referenced this issue Sep 11, 2023
chgayane pushed a commit that referenced this issue Sep 12, 2023
Nitvex added a commit that referenced this issue Sep 22, 2023
)

* #2518 - updated npm dependencies

* #2518 - Remove unused 'openFile' variable declaration

* #2518 - additional updates in dependenices

* #2518 - additional updates in eslint dependenices

* #2518 - fixed eslint confilcting files

* #2518 - fixed eslint confilcting files

* Fixed failing test

---------

Co-authored-by: Gayane Chilingaryan <gayane_chilingaryan@epam.com>
Co-authored-by: Nikita_Vozisov <Nikita_Vozisov@epam.com>
SashaGraves pushed a commit that referenced this issue Sep 28, 2023
)

* #2518 - updated npm dependencies

* #2518 - Remove unused 'openFile' variable declaration

* #2518 - additional updates in dependenices

* #2518 - additional updates in eslint dependenices

* #2518 - fixed eslint confilcting files

* #2518 - fixed eslint confilcting files

* Fixed failing test

---------

Co-authored-by: Gayane Chilingaryan <gayane_chilingaryan@epam.com>
Co-authored-by: Nikita_Vozisov <Nikita_Vozisov@epam.com>
@Zhirnoff
Copy link
Collaborator

Not tested by QA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: Done
Development

Successfully merging a pull request may close this issue.

5 participants