apostrophecms / apostrophecms/apostrophe
Moment.js version added on assets has vulnerabilities
- Dominant language
- JavaScript
- Stars
- 4.6k
- Forks
- 650
- Avg merge
- 19h 21m
- Merged PRs (30d)
- 23
Description
## Details
Doing a security scan on a website made using the latest version from Apostrohe v2, I've noticed that the moment.js version which is being imported on apostrophe-assets module is outdated and has some vulnerabilities as it's indicated on this link.
https://security.snyk.io/package/npm/moment
Can this be updated to solve the security issue?
Thanks in advance!
Contributor guide
Research direction
Start by locating the moment.js dependency used by the apostrophe-assets module and compare its version with the security report linked in the issue. Update the dependency and verify that the reported vulnerabilities are resolved without breaking the asset build or related checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100