Automatically closed - issue fixed for 2 weeks with no activity.
yarn audit is showing one vulnerability on 10.1.x, and multiple vulnerabilities on lower branches.
cd core
rm -rf node_modules
yarn install
yarn audit
yarn upgrade
yarn vendor-update
yarn build
yarn audit
There are no changes to built assets or production dependencies with the current approach, so no un-minification to audit them is required.
A Nightwatch dependency has a critical vulnerability on 9.x that is not addressed by upgrades allowed by the current constraints:
yarn audit v1.22.17
───────────────┬──────────────────────────────────────────────────────────────┐
│ critical │ flat vulnerable to Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ flat │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=5.0.1 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ nightwatch │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ nightwatch > mocha > yargs-unparser > flat │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://www.npmjs.com/advisories/1085318 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high │ minimatch ReDoS vulnerability │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ minimatch │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=3.0.5 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ nightwatch │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ nightwatch > minimatch │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://www.npmjs.com/advisories/1085778 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high │ minimatch ReDoS vulnerability │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ minimatch │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=3.0.5 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ nightwatch │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ nightwatch > mocha > minimatch │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://www.npmjs.com/advisories/1085778 │
└───────────────┴──────────────────────────────────────────────────────────────┘
3 vulnerabilities found - Packages audited: 1184
Severity: 2 High | 1 Critical
✨ Done in 1.43s.
JavaScript dependencies have been updated to their latest patch releases to fix security issues.
Fixed
9.4
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
Automatically closed - issue fixed for 2 weeks with no activity.