Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Resolve depricated npm dependecies #4663

Closed
ManuGowda opened this issue Dec 12, 2022 · 0 comments
Closed

Resolve depricated npm dependecies #4663

ManuGowda opened this issue Dec 12, 2022 · 0 comments
Assignees
Labels
dependencies Pull requests that update a dependency file type: security type: task
Milestone

Comments

@ManuGowda
Copy link
Contributor

ManuGowda commented Dec 12, 2022

Description

The lisk-desktop application uses electron version 17.2.0 which reached end of life in August 2022, as can be seen in electron's versions timeline. At the time of this writing the latest electron version is 25.0.0. By running an old electron version, lisk-desktop is also running an old Chromium version. The latest version of chromium is M114, but lisk-desktop uses version M98, a version released in February 2022 that contains several known vulnerabilities (1-days). Besides lisk-desktop the desktop application also contains several other vulnerable dependencies. Running npm audit yields 20 high, 109 moderate and 3 low severity vulnerabilities. We did not assess if these vulnerabilities impact lisk-desktop.

There are other dependencies that are outdated as well.

got  <11.8.5
Severity: moderate
Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97
jsdom  <=16.4.0
Severity: moderate
Insufficient Granularity of Access Control in JSDom - https://github.com/advisories/GHSA-f4c9-cqv8-9v98

This vulnerability comes from the latest version of jest-enzyme. 
![image](https://user-images.githubusercontent.com/8784876/201142072-8e9ece89-5af4-4e0a-b2a5-ee3f11955b63.png)
ws  6.0.0 - 6.2.1
Severity: moderate
ReDoS in Sec-Websocket-Protocol header - https://github.com/advisories/GHSA-6fc8-4gx4-v693
html-parse-stringify2 *
Severity: moderate
Regular expression denial of service (ReDoS) - https://github.com/advisories/GHSA-545q-3fg6-48m7

Acceptance Criteria

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file type: security type: task
Projects
No open projects
Development

No branches or pull requests

2 participants