Skip to content

Conversation

@nextcloud-command
Copy link
Contributor

@nextcloud-command nextcloud-command commented Sep 1, 2024

Audit report

This audit fix resolves 4 of the total 6 vulnerabilities found in your project.

Updated dependencies

Fixed vulnerabilities

@vue/component-compiler-utils #

  • Caused by vulnerable dependency:
  • Affected versions: *
  • Package usage:
    • node_modules/@vue/component-compiler-utils

postcss #

  • PostCSS line return parsing error
  • Severity: moderate (CVSS 5.3)
  • Reference: GHSA-7fh5-64p2-3v2j
  • Affected versions: <8.4.31
  • Package usage:
    • node_modules/@vue/component-compiler-utils/node_modules/postcss

vue-loader #

  • Caused by vulnerable dependency:
  • Affected versions: 15.0.0-beta.1 - 15.11.1
  • Package usage:
    • node_modules/vue-loader

webpack #

  • Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS
  • Severity: moderate (CVSS 6.4)
  • Reference: GHSA-4vvj-4cpr-p986
  • Affected versions: 5.0.0-alpha.0 - 5.93.0
  • Package usage:
    • node_modules/webpack

@nextcloud-command nextcloud-command force-pushed the automated/noid/stable30-fix-npm-audit branch from 9a307ee to fa78398 Compare September 8, 2024 03:33
@nickvergessen
Copy link
Member

/compile /

@nickvergessen nickvergessen merged commit f650ce8 into stable30 Sep 9, 2024
@nickvergessen nickvergessen deleted the automated/noid/stable30-fix-npm-audit branch September 9, 2024 12:33
This was referenced Sep 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants