github-tools / github-tools/github

Upgrade dependencies

Ouverte
#549 1 commentaire 1 réaction 0 personnes assignées Voir sur GitHub
Langage dominant
JavaScript
Étoiles
3.8k
Forks
809
Métriques de merge des PR
Aucune PR mergée en 30 j

Description

npm audit gives
```
found 46 vulnerabilities (21 low, 19 moderate, 5 high, 1 critical) in 6373 scanned packages
39 vulnerabilities require semver-major dependency updates.
7 vulnerabilities require manual review. See the full report for details.
```

The one critical vulnerability is
```
Critical Command Injection
Package growl
Dependency of mocha [dev]
Path mocha > growl
More info https://nodesecurity.io/advisories/146
```
This requires growl to be greater than version 1.10.2, which requires mocha to be at least 4.0.1. Currently mocha 3.1.2 is being used.

Guide de contribution

Aucun guide de contribution indexé pour ce dépôt

Piste de recherche

Start by running npm audit and reviewing the reported mocha > growl dependency path, including the advisory details. Determine which of the listed vulnerabilities can be resolved through dependency updates and which require manual review; done means the critical issue and the broader audit findings have been addressed or documented.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
javascript
Domaine
security, tooling
Type d'issue
Bug
Difficulté
4/5
Temps estimé
3-5 jours
Activité
À l'abandon
Clarté
Plutôt claire
Accessibilité débutants
25/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.