helbing / generator-helbing

My all code templates, created by yeoman

generator-helbing

This is my all code templates.

Installation

npm install -g yo
npm install -g generator-helbing

yo helbing

generator-helbing's Issues

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• chore(deps): update dependency vitest to v2.0.3
• chore(deps): update typescript-eslint monorepo to v7.16.1 (@typescript-eslint/eslint-plugin, @typescript-eslint/parser)
• chore(deps): update dependency eslint-plugin-prettier to v5.2.1
• chore(deps): update dependency husky to v9.1.1
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

npm

package.json

• chalk ^5.3.0
• yeoman-generator ^7.1.1
• @commitlint/cli ^19.0.0
• @commitlint/config-conventional ^19.0.0
• @types/yeoman-assert ^3.1.4
• @types/yeoman-generator ^5.2.14
• @types/yeoman-test ^4.0.6
• @typescript-eslint/eslint-plugin ^7.0.0
• @typescript-eslint/parser ^7.0.0
• cpy-cli ^5.0.0
• eslint ^9.0.0
• eslint-config-prettier ^9.1.0
• eslint-import-resolver-typescript ^3.6.1
• eslint-plugin-import ^2.29.1
• eslint-plugin-prettier ^5.1.2
• eslint-plugin-vitest ^0.5.0
• husky ^9.0.0
• lint-staged ^15.2.0
• prettier ^3.1.1
• rimraf ^6.0.0
• typescript ^5.3.3
• vitest ^2.0.0
• yeoman-assert ^3.1.1
• yeoman-environment ^4.1.3
• yeoman-test ^8.2.0

nvm

.nvmrc

• node 20.15.1

---

• Check this box to trigger a request for Renovate to run again on this repository

yeoman-environment-4.4.0.tgz: 1 vulnerabilities (highest severity is: 6.5) - autoclosed

Vulnerable Library - yeoman-environment-4.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/.pnpm/[email protected]/node_modules/tar/package.json

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (yeoman-environment version)	Remediation Possible**
CVE-2024-28863	Medium	6.5	tar-6.2.0.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-28863

Vulnerable Library - tar-6.2.0.tgz

Library home page: https://registry.npmjs.org/tar/-/tar-6.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/.pnpm/[email protected]/node_modules/tar/package.json

Dependency Hierarchy:

• yeoman-environment-4.4.0.tgz (Root Library)
  • fly-import-0.4.0.tgz
    • arborist-7.4.0.tgz
      • run-script-7.0.4.tgz
        • node-gyp-10.0.1.tgz
          • ❌ tar-6.2.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

Publish Date: 2024-03-21

URL: CVE-2024-28863

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f5x3-32g6-xq36

Release Date: 2024-03-21

Fix Resolution: tar - 6.2.1

Step up your Open Source Security Game with Mend here