Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Outdated version of @oclif/plugin-plugins causes high severity audit alerts #498

Open
gerardo-lima-moonfare opened this issue Oct 2, 2024 · 0 comments

Comments

@gerardo-lima-moonfare
Copy link

Q&A (please complete the following information)

  • CLI version: 0.9.0
  • OS: macOS Ventura
  • Node.js version: 20.15.0
  • SwaggerHub version if On-Premise: none

Describe the bug you're encountering

swaggerhub-cli depends on an outdated version of @oclif/plugin-plugins that causes npm audit alerts

To reproduce...

Steps to reproduce the behavior:

  1. Install swaggerhub-cli
$ npm install swaggerhub-cli
  1. Execute command npm audit
$ npm audit
  1. See error
# npm audit report

ip  *
Severity: high
NPM IP package incorrectly identifies some private IP addresses as public - https://github.com/advisories/GHSA-78xj-cgh5-2h22
ip SSRF improper categorization in isPublic - https://github.com/advisories/GHSA-2p57-rm9w-gvfp
fix available via `npm audit fix`
node_modules/npm/node_modules/ip

tar  <6.2.1
Severity: moderate
Denial of service while parsing a tar file due to lack of folders count validation - https://github.com/advisories/GHSA-f5x3-32g6-xq36
fix available via `npm audit fix --force`
Will install swaggerhub-cli@0.7.2, which is a breaking change
node_modules/npm/node_modules/tar
  npm  <=10.5.0
  Depends on vulnerable versions of tar
  node_modules/npm
    @oclif/plugin-plugins  3.0.1 - 5.0.15 || 5.0.17
    Depends on vulnerable versions of npm
    node_modules/@oclif/plugin-plugins
      swaggerhub-cli  >=0.8.0
      Depends on vulnerable versions of @oclif/plugin-plugins
      node_modules/swaggerhub-cli

5 vulnerabilities (4 moderate, 1 high)

Expected behavior

Screenshots

Additional context or thoughts

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant