stackabletech / stackabletech/feature-tracker
Update dependencies
Open
Nobody has claimed this yet.
- Dominant language
- Svelte
- Stars
- 1
- Forks
- 1
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 1
Description
# npm audit report
ip *
Severity: high
NPM IP package vulnerable to Server-Side Request Forgery (SSRF) attacks - https://github.com/advisories/GHSA-78xj-cgh5-2h22
fix available via `npm audit fix`
node_modules/npm/node_modules/ip
socks 1.0.0 - 2.7.1
Depends on vulnerable versions of ip
node_modules/npm/node_modules/socks
semver 7.0.0 - 7.5.1
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix --force`
Will install npm@10.4.0, which is a breaking change
node_modules/npm/node_modules/semver
npm 7.0.0-beta.0 - 9.7.1
Depends on vulnerable versions of semver
node_modules/npm
4 vulnerabilities (2 moderate, 2 high)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the npm audit report and the project's dependency manifests, then run npm audit to confirm the current findings. Update the affected npm dependencies or npm version while checking for breaking changes; done means the reported vulnerabilities are resolved and the project still installs and works.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100