ReviewMe icon indicating copy to clipboard operation
ReviewMe copied to clipboard

Update package-lock.json

Open PeterDaveHello opened this issue 2 years ago • 1 comments

This PR contains two commits:

  1. Sync dated package-lock.json with package.json
  2. Update dated/vulnerable packages in package-lock.json

Dated/vulnerable packages reference (npm audit report):

$ npm audit 
# npm audit report

ajv  <6.12.3
Severity: moderate
Prototype Pollution in Ajv - https://github.com/advisories/GHSA-v88g-cgmw-v5xw
fix available via `npm audit fix`
node_modules/har-validator/node_modules/ajv

got  <11.8.5
Severity: moderate
Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97
fix available via `npm audit fix`
node_modules/got

http-cache-semantics  <4.1.1
Severity: high
http-cache-semantics vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-rc47-6667-2j5j
fix available via `npm audit fix`
node_modules/http-cache-semantics

node-fetch  <2.6.7
Severity: high
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor - https://github.com/advisories/GHSA-r683-j2x4-v87g
fix available via `npm audit fix`
node_modules/node-fetch

qs  6.5.0 - 6.5.2 || 6.9.0 - 6.9.6
Severity: high
qs vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-hrpp-h998-j3pp
qs vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-hrpp-h998-j3pp
fix available via `npm audit fix`
node_modules/googleapis-common/node_modules/qs
node_modules/qs

request  *
Severity: moderate
Server-Side Request Forgery in Request - https://github.com/advisories/GHSA-p8p7-x288-28g6
No fix available
node_modules/request

6 vulnerabilities (3 moderate, 3 high)

To address issues that do not require attention, run:
  npm audit fix

Some issues need review, and may require choosing
a different dependency.

PeterDaveHello avatar Jun 04 '23 14:06 PeterDaveHello

BWT, the second commit can also replace #68 & #69 in the same time.

PeterDaveHello avatar Jun 04 '23 15:06 PeterDaveHello