Skip to content
This repository has been archived by the owner on Mar 6, 2023. It is now read-only.

Update dependencies to fix critical vulnerabilities #4

Open
nixolas1 opened this issue Mar 4, 2021 · 0 comments
Open

Update dependencies to fix critical vulnerabilities #4

nixolas1 opened this issue Mar 4, 2021 · 0 comments

Comments

@nixolas1
Copy link

nixolas1 commented Mar 4, 2021

When initializing the project I get notified of 4 high vuln. Full audit report:

➜ npm audit

npm audit report

ini <1.3.6
Prototype Pollution - https://npmjs.com/advisories/1589
fix available via npm audit fix
node_modules/ini

node-fetch <=2.6.0 || 3.0.0-beta.1 - 3.0.0-beta.8
Denial of Service - https://npmjs.com/advisories/1556
fix available via npm audit fix --force
Will install [email protected], which is outside the stated dependency range
node_modules/@ampproject/toolbox-optimizer/node_modules/node-fetch
node_modules/cross-fetch/node_modules/node-fetch
@ampproject/toolbox-optimizer 2.5.0-alpha.0 - 2.7.1-alpha.0
Depends on vulnerable versions of cross-fetch
Depends on vulnerable versions of node-fetch
node_modules/@ampproject/toolbox-optimizer
next 9.2.1-canary.0 - 10.0.7-canary.8
Depends on vulnerable versions of @ampproject/toolbox-optimizer
Depends on vulnerable versions of resolve-url-loader
node_modules/next
cross-fetch <=3.0.5
Depends on vulnerable versions of node-fetch
node_modules/cross-fetch
@ampproject/toolbox-validator-rules <=2.5.4
Depends on vulnerable versions of cross-fetch
node_modules/@ampproject/toolbox-validator-rules

object-path < 0.11.5
Severity: high
Prototype Pollution - https://npmjs.com/advisories/1573
fix available via npm audit fix --force
Will install [email protected], which is outside the stated dependency range
node_modules/object-path
adjust-sourcemap-loader 0.1.0 - 2.0.0
Depends on vulnerable versions of object-path
node_modules/adjust-sourcemap-loader
resolve-url-loader 0.0.1-experiment-postcss || 2.0.0 - 3.1.1 || 4.0.0-alpha.1
Depends on vulnerable versions of adjust-sourcemap-loader
node_modules/resolve-url-loader
next 9.2.1-canary.0 - 10.0.7-canary.8
Depends on vulnerable versions of @ampproject/toolbox-optimizer
Depends on vulnerable versions of resolve-url-loader
node_modules/next

9 vulnerabilities (5 low, 4 high)

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant