Skip to content
This repository was archived by the owner on Dec 28, 2022. It is now read-only.
This repository was archived by the owner on Dec 28, 2022. It is now read-only.

Problema com dependências do projeto #21

Closed

Description

@DevRadhy

O que está acontecendo?

Ao executar o build da imagem com Docker alguns errors e warns não mostrados na instalação dos pacotes, então rodando um npm audit, para ter as dependencias auditadas com o npm, aparece o seguinte problema:

# npm audit report

axios  <0.21.1
Severity: high
Server-Side Request Forgery - https://npmjs.com/advisories/1594
fix available via `npm audit fix --force`
Will install @nestjs/common@8.0.6, which is a breaking change
node_modules/axios
  @nestjs/common  4.6.0 - 7.6.4
  Depends on vulnerable versions of axios
  node_modules/@nestjs/common
    @nestjs/config  <=0.3.0
    Depends on vulnerable versions of @nestjs/common
    node_modules/@nestjs/config
    @nestjs/core  5.0.0-beta.0 - 7.0.0
    Depends on vulnerable versions of @nestjs/common
    node_modules/@nestjs/core
    @nestjs/jwt  <=6.1.2
    Depends on vulnerable versions of @nestjs/common
    node_modules/@nestjs/jwt
    @nestjs/passport  <=6.2.0
    Depends on vulnerable versions of @nestjs/common
    node_modules/@nestjs/passport
    @nestjs/platform-express  <=7.0.0
    Depends on vulnerable versions of @nestjs/common
    node_modules/@nestjs/platform-express

bcrypt  <5.0.0
Severity: moderate
Inadequate Encryption Strength - https://npmjs.com/advisories/1553
fix available via `npm audit fix --force`
Will install bcrypt@5.0.1, which is a breaking change
node_modules/bcrypt

glob-parent  <5.1.2
Severity: moderate
Regular expression denial of service - https://npmjs.com/advisories/1751
fix available via `npm audit fix --force`
Will install mqtt@4.2.8, which is a breaking change
node_modules/glob-stream/node_modules/glob-parent
  glob-stream  >=5.3.0
  Depends on vulnerable versions of glob-parent
  node_modules/glob-stream
    help-me  1.0.0 - 1.1.0
    Depends on vulnerable versions of glob-stream
    node_modules/help-me
      mqtt  1.14.1 - 4.2.6
      Depends on vulnerable versions of help-me
      node_modules/mqtt

mpath  <0.8.4
Severity: critical
Type confusion - https://npmjs.com/advisories/1785
fix available via `npm audit fix`
node_modules/mpath
  mongoose  3.6.0-rc0 - 5.13.8 || 6.0.0-rc0 - 6.0.3
  Depends on vulnerable versions of mpath
  node_modules/mongoose

tar  <=4.4.17 || 5.0.0 - 5.0.9 || 6.0.0 - 6.1.8
Severity: high
Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization - https://npmjs.com/advisories/1770
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning - https://npmjs.com/advisories/1771
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links - https://npmjs.com/advisories/1779
Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization - https://npmjs.com/advisories/1781
fix available via `npm audit fix`
node_modules/tar

15 vulnerabilities (5 moderate, 8 high, 2 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Activity

  1. caio-emidio commented on Sep 24, 2021

    @caio-emidio
    Contributor

    Estarei off pelas proximas 3 semanas. Tente ver com a @Isabelar07 . Caso ela nao consiga me avise q eu tento ajeitar um tempo nas minhas ferias para isso.

  2. added
    duplicateThis issue or pull request already exists
    on Sep 24, 2021
  3. vcwild commented on Sep 24, 2021

    @vcwild
    Member

    Duplicado da issue #20

  4. Isabelar07 commented on Sep 25, 2021

    @Isabelar07

    rodei o npm audit fix --force e resolveu todas as vulnerabilidades

  5. linked a pull request that will close this issueFix/dependency vulnerability #22on Sep 26, 2021
  6. vcwild commented on Sep 30, 2021

    @vcwild
    Member

    Mergeado

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't workingduplicateThis issue or pull request already exists

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions