AdguardTeam / AdguardTeam/HostlistCompiler
Dependencies with high severity vulnerabilities.
- 主要言語
- JavaScript
- スター
- 232
- フォーク
- 30
- PR マージ指標
- 30日以内にマージされた PR はありません
説明
I've used the commands using NPM to try to install the software and I get the following warnings:
`
# npm audit report
axios <=0.21.1
Severity: high
Server-Side Request Forgery in Axios - https://github.com/advisories/GHSA-4w2v-q235-vp99
Incorrect Comparison in axios - https://github.com/advisories/GHSA-cph5-m8f7-6c5x
Depends on vulnerable versions of follow-redirects
No fix available
node_modules/axios
@adguard/hostlist-compiler *
Depends on vulnerable versions of axios
Depends on vulnerable versions of better-ajv-errors
node_modules/@adguard/hostlist-compiler
follow-redirects <=1.14.7
Severity: high
Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects - https://github.com/advisories/GHSA-pw2r-vq6v-hr8c
Exposure of sensitive information in follow-redirects - https://github.com/advisories/GHSA-74fj-2j2h-c42q
No fix available
node_modules/follow-redirects
jsonpointer <5.0.0
Severity: moderate
Prototype Pollution in node-jsonpointer - https://github.com/advisories/GHSA-282f-qqgm-c34q
fix available via `npm audit fix`
node_modules/jsonpointer
better-ajv-errors <=0.8.1
Depends on vulnerable versions of jsonpointer
node_modules/better-ajv-errors
5 vulnerabilities (2 moderate, 3 high)
To address issues that do not require attention, run:
npm audit fix
Some issues need review, and may require choosing
a different dependency.`
Does updating these dependencies with a `npm audit fix --force` break functionality of the tool (looks like only jsonpointer has a fix available at this time)?
Can you please advise?
コントリビューションガイド
このリポジトリのコントリビューションガイドは索引されていません
評価
この issue はまだ評価されていません。