Skip to content

Comments

[master] Fix npm audit#1146

Merged
danxuliu merged 1 commit intomasterfrom
automated/noid/master-fix-npm-audit
Feb 18, 2025
Merged

[master] Fix npm audit#1146
danxuliu merged 1 commit intomasterfrom
automated/noid/master-fix-npm-audit

Conversation

@nextcloud-command
Copy link
Contributor

@nextcloud-command nextcloud-command commented Feb 16, 2025

Audit report

This audit fix resolves 17 of the total 17 vulnerabilities found in your project.

Updated dependencies

Fixed vulnerabilities

@linusborg/vue-simple-portal #

  • Caused by vulnerable dependency:
  • Affected versions: *
  • Package usage:
    • node_modules/@linusborg/vue-simple-portal

@nextcloud/dialogs #

  • Caused by vulnerable dependency:
  • Affected versions: >=4.2.0-beta.1
  • Package usage:
    • node_modules/@nextcloud/dialogs

@nextcloud/l10n #

  • Caused by vulnerable dependency:
  • Affected versions: 1.1.0 - 3.1.0
  • Package usage:
    • node_modules/@nextcloud/l10n

@nextcloud/vue #

@nextcloud/vue-select #

  • Caused by vulnerable dependency:
  • Affected versions: *
  • Package usage:
    • node_modules/@nextcloud/vue-select

@nextcloud/webpack-vue-config #

@vue/component-compiler-utils #

  • Caused by vulnerable dependency:
  • Affected versions: *
  • Package usage:
    • node_modules/@vue/component-compiler-utils

floating-vue #

  • Caused by vulnerable dependency:
  • Affected versions: <=1.0.0-beta.19
  • Package usage:
    • node_modules/floating-vue

node-gettext #

  • node-gettext vulnerable to Prototype Pollution
  • Severity: high (CVSS 5.9)
  • Reference: GHSA-g974-hxvm-x689
  • Affected versions: *
  • Package usage:
    • node_modules/node-gettext

pdfjs-dist #

  • PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
  • Severity: high (CVSS 8.8)
  • Reference: GHSA-wgrm-67xf-hhpq
  • Affected versions: <=4.1.392
  • Package usage:
    • node_modules/pdfjs-dist

postcss #

  • PostCSS line return parsing error
  • Severity: moderate (CVSS 5.3)
  • Reference: GHSA-7fh5-64p2-3v2j
  • Affected versions: <8.4.31
  • Package usage:
    • node_modules/@vue/component-compiler-utils/node_modules/postcss

vue #

  • ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function
  • Severity: low (CVSS 3.7)
  • Reference: GHSA-5j4c-8p2g-v4jx
  • Affected versions: 2.0.0-alpha.1 - 2.7.16
  • Package usage:
    • node_modules/vue

vue-frag #

  • Caused by vulnerable dependency:
  • Affected versions: >=1.3.1
  • Package usage:
    • node_modules/vue-frag

vue-loader #

  • Caused by vulnerable dependency:
  • Affected versions: 15.0.0-beta.1 - 15.11.1
  • Package usage:
    • node_modules/vue-loader

vue-resize #

  • Caused by vulnerable dependency:
  • Affected versions: 0.4.0 - 1.0.1
  • Package usage:
    • node_modules/vue-resize

vue-template-compiler #

  • vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
  • Severity: moderate (CVSS 4.2)
  • Reference: GHSA-g3ch-rx76-35fx
  • Affected versions: >=2.0.0
  • Package usage:
    • node_modules/vue-template-compiler

vue2-datepicker #

  • Caused by vulnerable dependency:
  • Affected versions: <=1.9.8 || 3.0.2 - 3.11.1
  • Package usage:
    • node_modules/vue2-datepicker

@nextcloud-command nextcloud-command added 3. to review dependencies Pull requests that update a dependency file labels Feb 16, 2025
danxuliu
danxuliu requested changes Feb 18, 2025
View reviewed changes
Copy link
Member

@danxuliu danxuliu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PDF.js version was bumped in package-lock.json, but it is still built with the previous version because it was not modified in package.json 🤔

@nextcloud-command @danxuliu
fix(deps): Fix npm audit
ab5f969 
Signed-off-by: GitHub <[email protected]>
Signed-off-by: Daniel Calviño Sánchez <[email protected]>
@danxuliu danxuliu force-pushed the automated/noid/master-fix-npm-audit branch from 6bef389 to ab5f969 Compare February 18, 2025 20:07
danxuliu
danxuliu approved these changes Feb 18, 2025
View reviewed changes
Copy link
Member

@danxuliu danxuliu left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested and works 👍

Rebased, npm audit fix was run again and pdfjs-dist reverted to 4.0.189, as isEvalSupported is explicitly set to false and therefore not affected by the security issue.

The previous comment about the mismatch between the PDF.js version actually used and the one listed in package-lock.json will be fixed in a different pull request, as it is unrelated to the audit fix itself.

@danxuliu danxuliu merged commit 65e19fc into master Feb 18, 2025
36 checks passed
@danxuliu danxuliu deleted the automated/noid/master-fix-npm-audit branch February 18, 2025 20:11
@danxuliu danxuliu mentioned this pull request Feb 24, 2025
Merged
@skjnldsv skjnldsv mentioned this pull request Aug 19, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@danxuliu danxuliu danxuliu approved these changes

Assignees

No one assigned

Labels

3. to review dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@nextcloud-command @danxuliu