Upgrade yarn dependencies to fix vulnerabilities shown by yarn audit

Created on 10 January 2023, almost 2 years ago
Updated 26 January 2023, almost 2 years ago

Problem/Motivation

yarn audit is showing one vulnerability on 10.1.x, and multiple vulnerabilities on lower branches.

Steps to reproduce

cd core
rm -rf node_modules
yarn install
yarn audit

Proposed resolution

yarn upgrade
yarn vendor-update
yarn build
yarn audit

There are no changes to built assets or production dependencies with the current approach, so no un-minification to audit them is required.

Remaining tasks

A Nightwatch dependency has a critical vulnerability on 9.x that is not addressed by upgrades allowed by the current constraints:

yarn audit v1.22.17
───────────────┬──────────────────────────────────────────────────────────────┐
│ critical      │ flat vulnerable to Prototype Pollution                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ flat                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.0.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ nightwatch                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ nightwatch > mocha > yargs-unparser > flat                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1085318                     │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ minimatch ReDoS vulnerability                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimatch                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.0.5                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ nightwatch                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ nightwatch > minimatch                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1085778                     │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ minimatch ReDoS vulnerability                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimatch                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.0.5                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ nightwatch                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ nightwatch > mocha > minimatch                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1085778                     │
└───────────────┴──────────────────────────────────────────────────────────────┘
3 vulnerabilities found - Packages audited: 1184
Severity: 2 High | 1 Critical
✨  Done in 1.43s.

User interface changes

API changes

Data model changes

Release notes snippet

JavaScript dependencies have been updated to their latest patch releases to fix security issues.

📌 Task
Status

Fixed

Version

9.4

Component
Other 

Last updated about 1 hour ago

Created by

🇺🇸United States xjm

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024