Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump dependencies through npm audit fix #323

Merged
merged 1 commit into from
Oct 23, 2024
Merged

Bump dependencies through npm audit fix #323

merged 1 commit into from
Oct 23, 2024

Conversation

dbanck
Copy link
Member

@dbanck dbanck commented Oct 23, 2024

This PR bumps 5 dependencies reported by npm audit

❯ npm audit
# npm audit report

@azure/identity  <4.2.1
Severity: moderate
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability - https://github.com/advisories/GHSA-m5vv-6r4h-3vj9
fix available via `npm audit fix`
node_modules/@azure/identity

@azure/msal-node  2.7.0 - 2.9.1
Severity: moderate
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability - https://github.com/advisories/GHSA-m5vv-6r4h-3vj9
fix available via `npm audit fix`
node_modules/@azure/msal-node

braces  <3.0.3
Severity: high
Uncontrolled resource consumption in braces - https://github.com/advisories/GHSA-grv7-fg5c-xmjg
fix available via `npm audit fix`
node_modules/braces

micromatch  <4.0.8
Severity: moderate
Regular Expression Denial of Service (ReDoS) in micromatch - https://github.com/advisories/GHSA-952p-6rrq-rcjv
fix available via `npm audit fix`
node_modules/micromatch

webpack  5.0.0-alpha.0 - 5.93.0
Severity: moderate
Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS - https://github.com/advisories/GHSA-4vvj-4cpr-p986
fix available via `npm audit fix`
node_modules/webpack

5 vulnerabilities (4 moderate, 1 high)

These reported vulnerabilities should have no impact on end users.

@dbanck dbanck added the dependencies Auto-pinning label Oct 23, 2024
@dbanck dbanck requested a review from a team as a code owner October 23, 2024 08:34
@dbanck dbanck mentioned this pull request Oct 23, 2024
@dbanck dbanck merged commit 8237a76 into main Oct 23, 2024
4 checks passed
@dbanck dbanck deleted the c-npm-audit-fix branch October 23, 2024 11:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Auto-pinning
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants