LinusU / LinusU/fs-temp

Audit report: 3 vulnerabilities (1 moderate, 2 high)

Open
#13 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
4
Forks
5
PR merge metrics
No merged PRs in 30d

Description

Installing the package dependencies reports 3 vulnerabilities.

```
npm install

up to date, audited 336 packages in 873ms

98 packages are looking for funding
run `npm fund` for details

3 vulnerabilities (1 moderate, 2 high)

To address all issues (including breaking changes), run:
npm audit fix --force

Run `npm audit` for details.
```

### Audit Report

```
minimatch <3.0.5
Severity: high
minimatch ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3
fix available via `npm audit fix --force`
Will install mocha@10.3.0, which is a breaking change
node_modules/minimatch
mocha 5.1.0 - 9.2.1
Depends on vulnerable versions of minimatch
Depends on vulnerable versions of nanoid
node_modules/mocha

nanoid 3.0.0 - 3.1.30
Severity: moderate
Exposure of Sensitive Information to an Unauthorized Actor in nanoid - https://github.com/advisories/GHSA-qrpm-p2h7-hrv2
fix available via `npm audit fix --force`
Will install mocha@10.3.0, which is a breaking change
node_modules/nanoid

3 vulnerabilities (1 moderate, 2 high)
```

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the dependency tree shown by npm audit, focusing on mocha and its vulnerable minimatch and nanoid versions. Review the breaking-change warning before updating dependencies, then rerun npm install and npm audit; done means the reported vulnerabilities are resolved without introducing an unreviewed incompatibility.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.