Commit afa0a78
Update dependencies to fix vulnerability (#20)
* Update dependencies to fix vulnerability
run `npm update`
update ws
update express
update webpack
* update express into 4.21.1
npm audit report
body-parser <1.20.3
Severity: high
body-parser vulnerable to denial of service when url encoding is enabled - GHSA-qwcr-r2fm-qrc7
fix available via `npm audit fix --force`
Will install express@4.21.1, which is outside the stated dependency range
node_modules/body-parser
express <=4.21.0 || 5.0.0-alpha.1 - 5.0.0
Depends on vulnerable versions of body-parser
Depends on vulnerable versions of cookie
Depends on vulnerable versions of path-to-regexp
Depends on vulnerable versions of send
Depends on vulnerable versions of serve-static
node_modules/express
cookie <0.7.0
cookie accepts cookie name, path, and domain with out of bounds characters - GHSA-pxg6-pf52-xh8x
fix available via `npm audit fix --force`
Will install express@4.21.1, which is outside the stated dependency range
node_modules/cookie
path-to-regexp <0.1.10
Severity: high
path-to-regexp outputs backtracking regular expressions - GHSA-9wv6-86v2-598j
fix available via `npm audit fix --force`
Will install express@4.21.1, which is outside the stated dependency range
node_modules/path-to-regexp
send <0.19.0
Severity: moderate
send vulnerable to template injection that can lead to XSS - GHSA-m6fv-jmcg-4jfg
fix available via `npm audit fix --force`
Will install express@4.21.1, which is outside the stated dependency range
node_modules/send
serve-static <=1.16.0
Depends on vulnerable versions of send
node_modules/serve-static
6 vulnerabilities (1 low, 2 moderate, 3 high)
---------
Co-authored-by: tomoya.kita <tomoya.kita@linecorp.com>1 parent 67409ae commit afa0a78
File tree
3 files changed
+589
-462
lines changed- packages
- headless-inspector
- liff-inspector
3 files changed
+589
-462
lines changed
0 commit comments