Skip to content

Conversation

@nextcloud-command
Copy link
Contributor

@nextcloud-command nextcloud-command commented Jan 19, 2025

Audit report

This audit fix resolves 15 of the total 25 vulnerabilities found in your project.

Updated dependencies

Fixed vulnerabilities

@nextcloud/dialogs #

  • Caused by vulnerable dependency:
  • Affected versions: >=4.2.0-beta.1
  • Package usage:
    • node_modules/@nextcloud/dialogs

@nextcloud/l10n #

  • Caused by vulnerable dependency:
  • Affected versions: 1.1.0 - 3.1.0
  • Package usage:
    • node_modules/@nextcloud/dialogs/node_modules/@nextcloud/l10n
    • node_modules/@nextcloud/files/node_modules/@nextcloud/l10n
    • node_modules/@nextcloud/l10n
    • node_modules/@nextcloud/upload/node_modules/@nextcloud/l10n
    • node_modules/@nextcloud/vue/node_modules/@nextcloud/l10n

@nextcloud/moment #

  • Caused by vulnerable dependency:
  • Affected versions: >=1.1.1
  • Package usage:
    • node_modules/@nextcloud/moment

@nextcloud/upload #

@nextcloud/webpack-vue-config #

@vue/component-compiler-utils #

  • Caused by vulnerable dependency:
  • Affected versions: *
  • Package usage:
    • node_modules/@vue/component-compiler-utils

@vue/test-utils #

  • Caused by vulnerable dependency:
  • Affected versions: <=1.3.6
  • Package usage:
    • node_modules/@vue/test-utils

axios #

  • Axios Cross-Site Request Forgery Vulnerability
  • Severity: moderate (CVSS 6.5)
  • Reference: GHSA-wf5p-g6vw-rhxx
  • Affected versions: 0.8.1 - 0.27.2
  • Package usage:
    • node_modules/webdav/node_modules/axios

node-gettext #

  • node-gettext vulnerable to Prototype Pollution
  • Severity: high (CVSS 5.9)
  • Reference: GHSA-g974-hxvm-x689
  • Affected versions: *
  • Package usage:
    • node_modules/node-gettext

postcss #

  • PostCSS line return parsing error
  • Severity: moderate (CVSS 5.3)
  • Reference: GHSA-7fh5-64p2-3v2j
  • Affected versions: <8.4.31
  • Package usage:
    • node_modules/@vue/component-compiler-utils/node_modules/postcss

vue-loader #

  • Caused by vulnerable dependency:
  • Affected versions: 15.0.0-beta.1 - 15.11.1
  • Package usage:
    • node_modules/vue-loader

vue-resize #

  • Caused by vulnerable dependency:
  • Affected versions: 0.4.0 - 1.0.1
  • Package usage:
    • node_modules/vue-resize

vue-template-compiler #

  • vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
  • Severity: moderate (CVSS 4.2)
  • Reference: GHSA-g3ch-rx76-35fx
  • Affected versions: >=2.0.0
  • Package usage:
    • node_modules/vue-template-compiler

vuex #

  • Caused by vulnerable dependency:
  • Affected versions: 3.1.3 - 3.6.2
  • Package usage:
    • node_modules/vuex

webdav #

  • Caused by vulnerable dependency:
  • Affected versions: 2.0.0-rc1 - 4.11.4
  • Package usage:
    • node_modules/webdav

@nextcloud-command nextcloud-command added 3. to review Waiting for reviews dependencies Pull requests that update a dependency file labels Jan 19, 2025
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable30-fix-npm-audit branch 2 times, most recently from 1814395 to 10b9d7d Compare February 2, 2025 03:26
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable30-fix-npm-audit branch 2 times, most recently from f7e2153 to 3da9d08 Compare February 12, 2025 16:01
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable30-fix-npm-audit branch from 3da9d08 to d6d377f Compare February 16, 2025 03:37
@artonge artonge force-pushed the automated/noid/stable30-fix-npm-audit branch from d6d377f to 24ba5d3 Compare February 19, 2025 14:16
@artonge
Copy link
Collaborator

artonge commented Feb 19, 2025

/compile amend /

1 similar comment
@artonge
Copy link
Collaborator

artonge commented Feb 19, 2025

/compile amend /

Signed-off-by: GitHub <[email protected]>
Signed-off-by: Louis Chemineau <[email protected]>
@artonge artonge force-pushed the automated/noid/stable30-fix-npm-audit branch from 48099ef to 13e1350 Compare February 20, 2025 14:00
@artonge
Copy link
Collaborator

artonge commented Feb 20, 2025

/compile amend /

Signed-off-by: Louis Chemineau <[email protected]>
Signed-off-by: nextcloud-command <[email protected]>
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable30-fix-npm-audit branch from 13e1350 to 6140c72 Compare February 20, 2025 14:04
@artonge artonge enabled auto-merge February 20, 2025 14:12
@artonge artonge merged commit b0c5719 into stable30 Feb 20, 2025
46 checks passed
@artonge artonge deleted the automated/noid/stable30-fix-npm-audit branch February 20, 2025 14:47
@blizzz blizzz mentioned this pull request Mar 4, 2025
13 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3. to review Waiting for reviews dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants