Skip to content

Conversation

@nextcloud-command
Copy link
Contributor

@nextcloud-command nextcloud-command commented Nov 10, 2024

Audit report

This audit fix resolves 10 of the total 19 vulnerabilities found in your project.

Updated dependencies

Fixed vulnerabilities

@nextcloud/dialogs #

@nextcloud/files #

  • Caused by vulnerable dependency:
  • Affected versions: >=1.1.0
  • Package usage:
    • node_modules/@nextcloud/files

@nextcloud/vite-config #

@vitejs/plugin-vue2 #

  • Caused by vulnerable dependency:
  • Affected versions: *
  • Package usage:
    • node_modules/@vitejs/plugin-vue2

@vue/language-core #

  • Caused by vulnerable dependency:
  • Affected versions: <=2.0.28
  • Package usage:
    • node_modules/@vue/language-core

cross-spawn #

  • Regular Expression Denial of Service (ReDoS) in cross-spawn
  • Severity: high (CVSS 7.5)
  • Reference: GHSA-3xgq-45jj-v275
  • Affected versions: 7.0.0 - 7.0.4
  • Package usage:
    • node_modules/cross-spawn

vite-plugin-dts #

  • Caused by vulnerable dependency:
  • Affected versions: 3.0.0-beta.1 - 4.0.0-beta.2
  • Package usage:
    • node_modules/vite-plugin-dts

vue-resize #

  • Caused by vulnerable dependency:
  • Affected versions: 0.4.0 - 1.0.1
  • Package usage:
    • node_modules/vue-resize

vue-template-compiler #

  • vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
  • Severity: moderate (CVSS 4.2)
  • Reference: GHSA-g3ch-rx76-35fx
  • Affected versions: >=2.0.0
  • Package usage:
    • node_modules/vue-template-compiler

vue-tsc #

  • Caused by vulnerable dependency:
  • Affected versions: 1.7.0-alpha.0 - 2.0.28
  • Package usage:
    • node_modules/vue-tsc

@nextcloud-command nextcloud-command added 3. to review dependencies Pull requests that update a dependency file labels Nov 10, 2024
@nextcloud-command nextcloud-command force-pushed the automated/noid/master-fix-npm-audit branch from 5b10a00 to 08695cd Compare November 17, 2024 03:25
@nextcloud-command nextcloud-command force-pushed the automated/noid/master-fix-npm-audit branch from 08695cd to c9182e6 Compare November 24, 2024 03:26
@nextcloud-command nextcloud-command force-pushed the automated/noid/master-fix-npm-audit branch 2 times, most recently from d7af52d to 9993f1e Compare December 8, 2024 03:37
@nextcloud-command nextcloud-command force-pushed the automated/noid/master-fix-npm-audit branch 2 times, most recently from 9fc9f7b to 531b629 Compare December 22, 2024 03:19
@nextcloud-command nextcloud-command force-pushed the automated/noid/master-fix-npm-audit branch 2 times, most recently from a56ac0e to 2748810 Compare January 5, 2025 03:10
@nextcloud-command nextcloud-command force-pushed the automated/noid/master-fix-npm-audit branch 2 times, most recently from 44ac40b to f984e0a Compare January 19, 2025 03:19
@nextcloud-command nextcloud-command force-pushed the automated/noid/master-fix-npm-audit branch from f984e0a to 5f83084 Compare January 26, 2025 03:22
@nextcloud-command nextcloud-command force-pushed the automated/noid/master-fix-npm-audit branch from 5f83084 to ab176b0 Compare January 29, 2025 21:25
@Pytal Pytal enabled auto-merge January 29, 2025 22:22
@Pytal Pytal merged commit 606fefb into master Jan 29, 2025
41 checks passed
@Pytal Pytal deleted the automated/noid/master-fix-npm-audit branch January 29, 2025 22:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3. to review dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants