You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by GitBox <gi...@apache.org> on 2022/02/06 19:00:00 UTC
[GitHub] [cloudstack] pjfanning opened a new issue #5950: upgrade javascript dependencies with security issues
pjfanning opened a new issue #5950:
URL: https://github.com/apache/cloudstack/issues/5950
<!--
Verify first that your issue/request is not already reported on GitHub.
Also test if the latest release and main branch are affected too.
Always add information AFTER of these HTML comments, but no need to delete the comments.
-->
##### ISSUE TYPE
<!-- Pick one below and delete the rest -->
* Bug Report
Have a look at the vulnerabilities in https://github.com/pjfanning/cloudstack/security/dependabot associated with package-lock.json
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] davidjumani commented on issue #5950: upgrade javascript dependencies with security issues
Posted by GitBox <gi...@apache.org>.
davidjumani commented on issue #5950:
URL: https://github.com/apache/cloudstack/issues/5950#issuecomment-1050547504
@pjfanning Let's check back on the dependencies when https://github.com/apache/cloudstack/pull/5151 is merged as it involves changing the vue library itself which could potentially fix some of the dependency vulnerabilities
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] pjfanning commented on issue #5950: upgrade javascript dependencies with security issues
Posted by GitBox <gi...@apache.org>.
pjfanning commented on issue #5950:
URL: https://github.com/apache/cloudstack/issues/5950#issuecomment-1063852947
Thanks for working on #5151 - it does fix a lot of the dependabot highlighted issues. There are still a number of CVEs present though. One example is https://github.com/advisories/GHSA-hgjh-723h-mx2j
Would it be possible to use `npm audit fix` on the latest code to see if there any low-hanging fruit changes that can be made?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] nvazquez commented on issue #5950: upgrade javascript dependencies with security issues
Posted by GitBox <gi...@apache.org>.
nvazquez commented on issue #5950:
URL: https://github.com/apache/cloudstack/issues/5950#issuecomment-1068696425
PR #6091 merged, @davidjumani can you please advise if there are more dependencies to update after the PR merged?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] nvazquez commented on issue #5950: upgrade javascript dependencies with security issues
Posted by GitBox <gi...@apache.org>.
nvazquez commented on issue #5950:
URL: https://github.com/apache/cloudstack/issues/5950#issuecomment-1063598950
PR #5151 got merged today - @davidjumani please advise if this issue is still valid after the vue upgrade
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] pjfanning commented on issue #5950: upgrade javascript dependencies with security issues
Posted by GitBox <gi...@apache.org>.
pjfanning commented on issue #5950:
URL: https://github.com/apache/cloudstack/issues/5950#issuecomment-1030901082
It's easy to get github to run dependabot analyses on your own github fork of apache/cloudstack - there is Security tab (between Wiki and Insights)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] rohityadavcloud commented on issue #5950: upgrade javascript dependencies with security issues
Posted by GitBox <gi...@apache.org>.
rohityadavcloud commented on issue #5950:
URL: https://github.com/apache/cloudstack/issues/5950#issuecomment-1030894896
That link gives a 404, maybe it's privately visible only @pjfanning ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] davidjumani commented on issue #5950: upgrade javascript dependencies with security issues
Posted by GitBox <gi...@apache.org>.
davidjumani commented on issue #5950:
URL: https://github.com/apache/cloudstack/issues/5950#issuecomment-1068788179
@utchoang Can you please check if updating this will cause breaking changes? Thanks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] davidjumani edited a comment on issue #5950: upgrade javascript dependencies with security issues
Posted by GitBox <gi...@apache.org>.
davidjumani edited a comment on issue #5950:
URL: https://github.com/apache/cloudstack/issues/5950#issuecomment-1050547504
@pjfanning Let's check back on the dependencies when https://github.com/apache/cloudstack/pull/5151 is merged as it involves changing the vue library itself which could potentially fix some of the dependency issues
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] pjfanning commented on issue #5950: upgrade javascript dependencies with security issues
Posted by GitBox <gi...@apache.org>.
pjfanning commented on issue #5950:
URL: https://github.com/apache/cloudstack/issues/5950#issuecomment-1030896275
@rohityadavcloud these are the dependencies from that github page.
```
nanoid
Moderate severity
shelljs
High severity
follow-redirects
High severity
json-schema
Moderate severity
ansi-regex
Moderate severity
nth-check
Moderate severity
tmpl
Moderate severity
axios
High severity
ansi-html
High severity
path-parse
Moderate severity
tar
High severity
@npmcli/git
Moderate severity
normalize-url
High severity
color-string
Moderate severity
trim-newlines
High severity
glob-parent
High severity
ws
Moderate severity
dns-packet
High severity
browserslist
Moderate severity
postcss
Moderate severity
hosted-git-info
Moderate severity
ssri
High severity
url-parse
High severity
lodash
High severity
merge
High severity
is-svg
High severity
y18n
High severity
elliptic
Moderate severity
node-notifier
Moderate severity
ini
High severity
highlight.js
Moderate severity
object-path
High severity
node-forge
High severity
node-fetch
High severity
bl
High severity
yargs-parser
Moderate severity
dot-prop
High severity
prismjs
High severity
serialize-javascript
High severity
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] pjfanning commented on issue #5950: upgrade javascript dependencies with security issues
Posted by GitBox <gi...@apache.org>.
pjfanning commented on issue #5950:
URL: https://github.com/apache/cloudstack/issues/5950#issuecomment-1068711910
thanks for looking into this - dependabot is still recommending this - https://github.com/apache/cloudstack/blob/main/ui/package.json#L89 to update to 7.0.0 - due to https://github.com/advisories/GHSA-r8f7-9pfq-mjmv
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] rohityadavcloud commented on issue #5950: upgrade javascript dependencies with security issues
Posted by GitBox <gi...@apache.org>.
rohityadavcloud commented on issue #5950:
URL: https://github.com/apache/cloudstack/issues/5950#issuecomment-1068835604
2cents - I think build dependencies can warning may be reviewed and ignored as the build depdencies aren't used to serve/run the webapp, we only use them to build a SPA (single page app) which is statically served by embedded Jetty. We don't use node-sass in prod.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [cloudstack] davidjumani commented on issue #5950: upgrade javascript dependencies with security issues
Posted by GitBox <gi...@apache.org>.
davidjumani commented on issue #5950:
URL: https://github.com/apache/cloudstack/issues/5950#issuecomment-1066336380
Can be fixed by https://github.com/apache/cloudstack/pull/6091
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org