Skip to content

chore(): fix dependencies vulnerabilities reported by npm audit #10599

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
May 13, 2025
Merged

chore(): fix dependencies vulnerabilities reported by npm audit #10599

merged 2 commits into from
May 13, 2025

Conversation

Smrtnyk
Copy link
Contributor

@Smrtnyk Smrtnyk commented May 12, 2025 •
edited by asturur
Loading

I noticed that when I run npm install that npm complains about vulnerable dependencies and recommends npm run audit fix to try to fix it.
I did this just to get rid of annoying warnings, otherwise I don't think it matters much

Fixes:

# npm audit report

@babel/helpers  <7.26.10
Severity: moderate
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - https://github.com/advisories/GHSA-968p-4wvh-cqc8
fix available via `npm audit fix`
node_modules/@babel/helpers

@babel/runtime  <7.26.10
Severity: moderate
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - https://github.com/advisories/GHSA-968p-4wvh-cqc8
fix available via `npm audit fix`
node_modules/@babel/runtime

body-parser  <1.20.3
Severity: high
body-parser vulnerable to denial of service when url encoding is enabled - https://github.com/advisories/GHSA-qwcr-r2fm-qrc7
fix available via `npm audit fix`
node_modules/body-parser
  express  <=4.21.1 || 5.0.0-alpha.1 - 5.0.0
  Depends on vulnerable versions of body-parser
  Depends on vulnerable versions of cookie
  Depends on vulnerable versions of path-to-regexp
  Depends on vulnerable versions of send
  Depends on vulnerable versions of serve-static
  node_modules/express

cookie  <0.7.0
cookie accepts cookie name, path, and domain with out of bounds characters - https://github.com/advisories/GHSA-pxg6-pf52-xh8x
fix available via `npm audit fix`
node_modules/cookie
node_modules/engine.io/node_modules/cookie
  engine.io  1.8.0 - 6.6.1
  Depends on vulnerable versions of cookie
  node_modules/engine.io
    socket.io  1.6.0 - 4.7.5
    Depends on vulnerable versions of engine.io
    node_modules/socket.io


path-to-regexp  <=0.1.11
Severity: high
Unpatched `path-to-regexp` ReDoS in 0.1.x - https://github.com/advisories/GHSA-rhx6-c78j-4q9w
path-to-regexp outputs backtracking regular expressions - https://github.com/advisories/GHSA-9wv6-86v2-598j
fix available via `npm audit fix`
node_modules/path-to-regexp

send  <0.19.0
send vulnerable to template injection that can lead to XSS - https://github.com/advisories/GHSA-m6fv-jmcg-4jfg
fix available via `npm audit fix`
node_modules/send
  serve-static  <=1.16.0
  Depends on vulnerable versions of send
  node_modules/serve-static


vite  6.3.0 - 6.3.3
Severity: moderate
Vite's server.fs.deny bypassed with /. for files under project root - https://github.com/advisories/GHSA-859w-5945-r5v3
fix available via `npm audit fix`
node_modules/vite

11 vulnerabilities (5 low, 3 moderate, 3 high)

To address all issues, run:
  npm audit fix

@Smrtnyk
chore(): run npm audit fix to fix a vulnerability report
1ba0d59 
 I noticed that when I run npm install that npm complains about vulnerable dependencies and recomments `npm run audit fix` to try to fix it.
 I did this just to get rid of annoying warnings, otherwise I don't think it matters much
@codesandbox CodeSandbox
Copy link

codesandbox bot commented May 12, 2025

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

@github-actions GitHub Actions
Copy link
Contributor

Build Stats

file / KB (diff) bundled minified
fabric 914.662 (0) 301.450 (0)

@Smrtnyk Smrtnyk closed this May 12, 2025
@Smrtnyk Smrtnyk reopened this May 12, 2025
@asturur
Copy link
Member

asturur commented May 12, 2025

which was the vulnerability? we should list it in the changelog for good if anyone comes for looking for a solution

@Smrtnyk
Copy link
Contributor Author

Smrtnyk commented May 12, 2025

you just need to run npm audit locally on fresh main
it outputs this

# npm audit report

@babel/helpers  <7.26.10
Severity: moderate
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - https://github.com/advisories/GHSA-968p-4wvh-cqc8
fix available via `npm audit fix`
node_modules/@babel/helpers

@babel/runtime  <7.26.10
Severity: moderate
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - https://github.com/advisories/GHSA-968p-4wvh-cqc8
fix available via `npm audit fix`
node_modules/@babel/runtime

body-parser  <1.20.3
Severity: high
body-parser vulnerable to denial of service when url encoding is enabled - https://github.com/advisories/GHSA-qwcr-r2fm-qrc7
fix available via `npm audit fix`
node_modules/body-parser
  express  <=4.21.1 || 5.0.0-alpha.1 - 5.0.0
  Depends on vulnerable versions of body-parser
  Depends on vulnerable versions of cookie
  Depends on vulnerable versions of path-to-regexp
  Depends on vulnerable versions of send
  Depends on vulnerable versions of serve-static
  node_modules/express

cookie  <0.7.0
cookie accepts cookie name, path, and domain with out of bounds characters - https://github.com/advisories/GHSA-pxg6-pf52-xh8x
fix available via `npm audit fix`
node_modules/cookie
node_modules/engine.io/node_modules/cookie
  engine.io  1.8.0 - 6.6.1
  Depends on vulnerable versions of cookie
  node_modules/engine.io
    socket.io  1.6.0 - 4.7.5
    Depends on vulnerable versions of engine.io
    node_modules/socket.io


path-to-regexp  <=0.1.11
Severity: high
Unpatched `path-to-regexp` ReDoS in 0.1.x - https://github.com/advisories/GHSA-rhx6-c78j-4q9w
path-to-regexp outputs backtracking regular expressions - https://github.com/advisories/GHSA-9wv6-86v2-598j
fix available via `npm audit fix`
node_modules/path-to-regexp

send  <0.19.0
send vulnerable to template injection that can lead to XSS - https://github.com/advisories/GHSA-m6fv-jmcg-4jfg
fix available via `npm audit fix`
node_modules/send
  serve-static  <=1.16.0
  Depends on vulnerable versions of send
  node_modules/serve-static


vite  6.3.0 - 6.3.3
Severity: moderate
Vite's server.fs.deny bypassed with /. for files under project root - https://github.com/advisories/GHSA-859w-5945-r5v3
fix available via `npm audit fix`
node_modules/vite

11 vulnerabilities (5 low, 3 moderate, 3 high)

To address all issues, run:
  npm audit fix

you can see the severity as well

@asturur
Copy link
Member

asturur commented May 13, 2025

yes is ok just i ll move that output in the pr description, that's all

@asturur asturur changed the title chore(): run npm audit fix to fix a vulnerability report chore(): fix dependencies vulnerabilities reported by npm audit May 13, 2025
@asturur asturur merged commit 2fad480 into fabricjs:master May 13, 2025
20 of 21 checks passed
@Smrtnyk Smrtnyk deleted the chore()-run-npm-audit-to-fix-vulnerabilities branch May 17, 2025 14:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@asturur asturur asturur approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@Smrtnyk @asturur