ionic-team / ionic-team/ionic-cli
Dependencies of @ionic/v1-toolkit have 10 vulnerabilities (2 low, 8 high)
- Dominant language
- TypeScript
- Stars
- 2k
- Forks
- 682
- PR merge metrics
- No merged PRs in 30d
Description
**Description:**
When creating a new Ionic-v1 project which includes the Ionic toolkit. When I then install ionic-native using
```
npm i ionic-native --save
```
I get the following (npm audit fix doesn't fix any vulnerabilities):
**Output:**
=== npm audit security report ===
Run npm install --save-dev gulp@4.0.0 to resolve 5 vulnerabilities
SEMVER WARNING: Recommended action is a potentially breaking change
Low Prototype Pollution
Package lodash
Dependency of gulp [dev]
Path gulp > vinyl-fs > glob-watcher > gaze > globule > lodash
More info https://nodesecurity.io/advisories/577
High Regular Expression Denial of Service
Package minimatch
Dependency of gulp [dev]
Path gulp > vinyl-fs > glob-stream > glob > minimatch
More info https://nodesecurity.io/advisories/118
High Regular Expression Denial of Service
Package minimatch
Dependency of gulp [dev]
Path gulp > vinyl-fs > glob-stream > minimatch
More info https://nodesecurity.io/advisories/118
High Regular Expression Denial of Service
Package minimatch
Dependency of gulp [dev]
Path gulp > vinyl-fs > glob-watcher > gaze > globule > glob >
minimatch
More info https://nodesecurity.io/advisories/118
High Regular Expression Denial of Service
Package minimatch
Dependency of gulp [dev]
Path gulp > vinyl-fs > glob-watcher > gaze > globule > minimatch
More info https://nodesecurity.io/advisories/118
Manual Review
Some vulnerabilities require your attention to resolve
Visit https://go.npm.me/audit-guide for additional guidance
High Regular Expression Denial of Service
Package minimatch
Patched in >=3.0.2
Dependency of @ionic/v1-toolkit [dev]
Path @ionic/v1-toolkit > gulp > vinyl-fs > glob-stream > glob >
minimatch
More info https://nodesecurity.io/advisories/118
High Regular Expression Denial of Service
Package minimatch
Patched in >=3.0.2
Dependency of @ionic/v1-toolkit [dev]
Path @ionic/v1-toolkit > gulp > vinyl-fs > glob-stream >
minimatch
More info https://nodesecurity.io/advisories/118
High Regular Expression Denial of Service
Package minimatch
Patched in >=3.0.2
Dependency of @ionic/v1-toolkit [dev]
Path @ionic/v1-toolkit > gulp > vinyl-fs > glob-watcher > gaze >
globule > glob > minimatch
More info https://nodesecurity.io/advisories/118
High Regular Expression Denial of Service
Package minimatch
Patched in >=3.0.2
Dependency of @ionic/v1-toolkit [dev]
Path @ionic/v1-toolkit > gulp > vinyl-fs > glob-watcher > gaze >
globule > minimatch
More info https://nodesecurity.io/advisories/118
Low Prototype Pollution
Package lodash
Patched in >=4.17.5
Dependency of @ionic/v1-toolkit [dev]
Path @ionic/v1-toolkit > gulp > vinyl-fs > glob-watcher > gaze >
globule > lodash
More info https://nodesecurity.io/advisories/577
found 10 vulnerabilities (2 low, 8 high) in 6476 scanned packages
5 vulnerabilities require semver-major dependency updates.
5 vulnerabilities require manual review. See the full report for details.
**My `ionic info`:**
I'm using Ionic CLI 4.5.0
Contributor guide
Research direction
No source file or test is named. Start by locating the package metadata for @ionic/v1-toolkit and reproduce the npm audit report, then trace its gulp dependency chain. Done means resolving the listed minimatch and lodash vulnerabilities and confirming the audit no longer reports them.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript
- Domain
- cli, security, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100