downstream vulnerability issue reported by Snyk

Created on 12 June 2024, 4 months ago
Updated 14 June 2024, 4 months ago

Problem/Motivation

We have a project where our backend is in Drupal and Front end is ReactJS. Before deployment, there is security scan happening through `Snyk` software. That is giving `GPL-2.0 license` issue as High level risk into `composer.lock` file to all contributed modules mentioned there. Is there any way we can fix it?

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

💬 Support request
Status

Closed: won't fix

Version

2.0

Component
Other 

Last updated about 1 hour ago

Created by

🇮🇳India pradeepjha

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @pradeepjha
  • Status changed to Closed: duplicate 4 months ago
  • Status changed to Postponed: needs info 4 months ago
  • It is not clear in the PNG you provided what is actually "wrong" here. Without information about what these vulnerabilities are you will have to contact Synk support.

  • 🇦🇺Australia larowlan 🇦🇺🏝.au GMT+10

    Can you share the output of `composer outdated`

  • 🇮🇳India pradeepjha

    Hi @larowlan Please find attached screenshot of `composer outdated` output:

    @cilefen Actually When composer lock file is getting scanned through Snyk security tool. Almost all contributed modules version line it's giving `GPL-2.0 license` as high level risk. Not sure how can we fix that.

  • I am not sure either. That's a question for Snyk.

  • 🇦🇺Australia larowlan 🇦🇺🏝.au GMT+10

    There's no output from composer outdated but I agree with @cilefen - this is a question for snyk

  • Status changed to Closed: won't fix 4 months ago
  • 🇦🇺Australia acbramley

    This doesn't seem like something this module can deal with. Snyk is notoriously bad at false negatives.

Production build 0.71.5 2024