cube-js / cube-js/cube

Orca flags vulnerability in tmp package

Open
#10,156 0 comments 0 reactions 0 assignees View on GitHub
security
Dominant language
Rust
Stars
20.8k
Forks
2.1k
Avg merge
1d 2h
Merged PRs (30d)
181

Description

Orca is flagging vulnerability in the `tmp` package, thus blocking deployment.

Image

```
yarn why v1.22.19
[1/4] 🤔 Why do we have the module "tmp"...?
[2/4] 🚚 Initialising dependency graph...
(node:25227) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
(Use `node --trace-deprecation ...` to show where the warning was created)
warning Resolution field "es5-ext@0.10.53" is incompatible with requested version "es5-ext@^0.10.64"
warning Resolution field "thrift@0.20.0" is incompatible with requested version "thrift@^0.9.3"
warning Resolution field "tmp@0.2.4" is incompatible with requested version "tmp@^0.0.33"
warning Resolution field "tmp@0.2.4" is incompatible with requested version "tmp@^0.1.0"
[3/4] 🔍 Finding dependency...
[4/4] 🚡 Calculating file sizes...
=> Found "tmp@0.2.4"
info Reasons this module exists
- "_project_#@cubejs-backend#elasticsearch-driver#testcontainers" depends on it
- Hoisted from "_project_#@cubejs-backend#elasticsearch-driver#testcontainers#tmp"
- Hoisted from "_project_#lerna#@nx#devkit#tmp"
- Hoisted from "_project_#lerna#nx#tmp"
- Hoisted from "_project_#@cubejs-backend#testing#cypress#tmp"
- Hoisted from "_project_#cubejs-cli#inquirer#external-editor#tmp"
- Hoisted from "_project_#@cubejs-backend#server#@oclif#dev-cli#qqjs#tmp"
info Disk size without dependencies: "52KB"
info Disk size with unique dependencies: "52KB"
info Disk size with transitive dependencies: "52KB"
info Number of shared dependencies: 0
✨ Done in 0.62s.
```

@paveltiunov Could you please suggest what could be done?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.