This repository was archived by the owner on Sep 8, 2021. It is now read-only.
This repository was archived by the owner on Sep 8, 2021. It is now read-only.
Security Issues from Yarn Audit #17
Open
Description
It would appear that this plugin has some audit issues that need to be addressed:
yarn audit v1.22.0
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low │ Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ minimist │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.2.1 <1.0.0 || >=1.2.3 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ vue-cli-plugin-netlify-lambda │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ vue-cli-plugin-netlify-lambda > jest > jest-cli > │
│ │ istanbul-api > istanbul-reports > handlebars > optimist > │
│ │ minimist │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://www.npmjs.com/advisories/1179 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high │ Arbitrary File Write │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ decompress │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ No patch available │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ vue-cli-plugin-netlify-lambda │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ vue-cli-plugin-netlify-lambda > @vue/cli > download-git-repo │
│ │ > download > decompress │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://www.npmjs.com/advisories/1217 │
└───────────────┴──────────────────────────────────────────────────────────────┘
This is causing some issues for me as yarn audit
is built into my CI/CD process.
Metadata
Metadata
Assignees
Labels
No labels