apostrophecms / apostrophecms/apostrophe

Moment.js version added on assets has vulnerabilities

Open
#4,106 3 comments 0 reactions 0 assignees View on GitHub
question
Dominant language
JavaScript
Stars
4.6k
Forks
650
Avg merge
19h 21m
Merged PRs (30d)
23

Description

## Details

Doing a security scan on a website made using the latest version from Apostrohe v2, I've noticed that the moment.js version which is being imported on apostrophe-assets module is outdated and has some vulnerabilities as it's indicated on this link.

https://security.snyk.io/package/npm/moment

Can this be updated to solve the security issue?

Thanks in advance!

Contributor guide

Open the contributing guide

Research direction

Start by locating the moment.js dependency used by the apostrophe-assets module and compare its version with the security report linked in the issue. Update the dependency and verify that the reported vulnerabilities are resolved without breaking the asset build or related checks.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.