markblackburn77 / gatsby-starter-blog

Gatsby starter for creating a blog

Gatsby's blog starter

Kick off your project with this blog boilerplate. This starter ships with the main Gatsby configuration files you might need to get up and running blazing fast with the blazing fast app generator for React.

Have another more specific idea? You may want to check out our vibrant collection of official and community-created starters.

🚀 Quick start

1. Create a Gatsby site.

   Use the Gatsby CLI to create a new site, specifying the blog starter.

   # create a new Gatsby site using the blog starter
   gatsby new my-blog-starter https://github.com/gatsbyjs/gatsby-starter-blog

2. Start developing.

   Navigate into your new site’s directory and start it up.

   cd my-blog-starter/
   gatsby develop

3. Open the source code and start editing!

   Your site is now running at http://localhost:8000!

   Note: You'll also see a second link: http://localhost:8000/___graphql. This is a tool you can use to experiment with querying your data. Learn more about using this tool in the Gatsby tutorial.

   Open the my-blog-starter directory in your code editor of choice and edit src/pages/index.js. Save your changes and the browser will update in real time!

🧐 What's inside?

A quick look at the top-level files and directories you'll see in a Gatsby project.

.
├── node_modules
├── src
├── .gitignore
├── .prettierrc
├── gatsby-browser.js
├── gatsby-config.js
├── gatsby-node.js
├── gatsby-ssr.js
├── LICENSE
├── package-lock.json
├── package.json
└── README.md

1. /node_modules: This directory contains all of the modules of code that your project depends on (npm packages) are automatically installed.

2. /src: This directory will contain all of the code related to what you will see on the front-end of your site (what you see in the browser) such as your site header or a page template. src is a convention for “source code”.

3. .gitignore: This file tells git which files it should not track / not maintain a version history for.

4. .prettierrc: This is a configuration file for Prettier. Prettier is a tool to help keep the formatting of your code consistent.

5. gatsby-browser.js: This file is where Gatsby expects to find any usage of the Gatsby browser APIs (if any). These allow customization/extension of default Gatsby settings affecting the browser.

6. gatsby-config.js: This is the main configuration file for a Gatsby site. This is where you can specify information about your site (metadata) like the site title and description, which Gatsby plugins you’d like to include, etc. (Check out the config docs for more detail).

7. gatsby-node.js: This file is where Gatsby expects to find any usage of the Gatsby Node APIs (if any). These allow customization/extension of default Gatsby settings affecting pieces of the site build process.

8. gatsby-ssr.js: This file is where Gatsby expects to find any usage of the Gatsby server-side rendering APIs (if any). These allow customization of default Gatsby settings affecting server-side rendering.

9. LICENSE: This Gatsby starter is licensed under the 0BSD license. This means that you can see this file as a placeholder and replace it with your own license.

10. package-lock.json (See package.json below, first). This is an automatically generated file based on the exact versions of your npm dependencies that were installed for your project. (You won’t change this file directly).

11. package.json: A manifest file for Node.js projects, which includes things like metadata (the project’s name, author, etc). This manifest is how npm knows which packages to install for your project.

12. README.md: A text file containing useful reference information about your project.

🎓 Learning Gatsby

Looking for more guidance? Full documentation for Gatsby lives on the website. Here are some places to start:

• For most developers, we recommend starting with our in-depth tutorial for creating a site with Gatsby. It starts with zero assumptions about your level of ability and walks through every step of the process.

• To dive straight into code samples, head to our documentation. In particular, check out the Guides, API Reference, and Advanced Tutorials sections in the sidebar.

💫 Deploy

gatsby-starter-blog's Issues

[DepShield] (CVSS 5.3) Vulnerability due to usage of browserslist:4.14.2

Vulnerabilities

DepShield reports that this application's usage of browserslist:4.14.2 results in the following vulnerability(s):

• (CVSS 5.3) [CVE-2021-23364] The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular ...

---

Occurrences

browserslist:4.14.2 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ react-dev-utils:11.0.4
              └─ browserslist:4.14.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.get:4.4.2

Vulnerabilities

DepShield reports that this application's usage of lodash.get:4.4.2 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.get:4.4.2 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ eslint-plugin-graphql:4.0.0
              └─ graphql-config:3.4.1
                    └─ @endemolshinegroup/cosmiconfig-typescript-loader:3.0.2
                          └─ lodash.get:4.4.2

• gatsby-plugin-gatsby-cloud:4.3.0
        └─ webpack-assets-manifest:5.0.6
              └─ lodash.get:4.4.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of object-path:0.11.5

Vulnerabilities

DepShield reports that this application's usage of object-path:0.11.5 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

object-path:0.11.5 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ graphql-compose:7.25.1
              └─ object-path:0.11.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 8.2) Vulnerability due to usage of sanitize-html:1.27.5

Vulnerabilities

DepShield reports that this application's usage of sanitize-html:1.27.5 results in the following vulnerability(s):

• (CVSS 8.2) CWE-20: Improper Input Validation
• (CVSS 8.2) CWE-20: Improper Input Validation

---

Occurrences

sanitize-html:1.27.5 is a transitive dependency introduced by the following direct dependency(s):

• gatsby-transformer-remark:5.3.0
        └─ sanitize-html:1.27.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of ini:1.3.8

Vulnerabilities

DepShield reports that this application's usage of ini:1.3.8 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

ini:1.3.8 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ react-dev-utils:11.0.4
              └─ global-modules:2.0.0
                    └─ global-prefix:3.0.0
                          └─ ini:1.3.8

• gatsby-plugin-manifest:4.3.0
        └─ sharp:0.29.3
              └─ prebuild-install:7.0.0
                    └─ rc:1.2.8
                          └─ ini:1.3.8

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of debug:2.6.9

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.9 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

debug:2.6.9 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ body-parser:1.19.0
              └─ debug:2.6.9
        └─ compression:1.7.4
              └─ debug:2.6.9
        └─ detect-port:1.3.0
              └─ debug:2.6.9
        └─ eslint-plugin-import:2.25.3
              └─ debug:2.6.9
        └─ express:4.17.1
              └─ debug:2.6.9
              └─ finalhandler:1.1.2
                    └─ debug:2.6.9
              └─ send:0.17.1
                    └─ debug:2.6.9
        └─ react-dev-utils:11.0.4
              └─ fork-ts-checker-webpack-plugin:4.1.6
                    └─ micromatch:3.1.10
                          └─ extglob:2.0.4
                                └─ expand-brackets:2.1.4
                                      └─ debug:2.6.9
                          └─ snapdragon:0.8.2
                                └─ debug:2.6.9
              └─ detect-port-alt:1.1.6
                    └─ debug:2.6.9

• gatsby-plugin-sharp:4.3.0
        └─ probe-image-size:6.0.0
              └─ stream-parser:0.3.1
                    └─ debug:2.6.9

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 4.3) Vulnerability due to usage of bl:4.1.0

Vulnerabilities

DepShield reports that this application's usage of bl:4.1.0 results in the following vulnerability(s):

• (CVSS 4.3) CWE-200: Information Exposure

---

Occurrences

bl:4.1.0 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ st:2.0.0
              └─ bl:4.1.0

• gatsby-plugin-manifest:4.3.0
        └─ sharp:0.29.3
              └─ tar-fs:2.1.1
                    └─ tar-stream:2.2.0
                          └─ bl:4.1.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:3.2.2

Vulnerabilities

DepShield reports that this application's usage of kind-of:3.2.2 results in the following vulnerability(s):

• (CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

---

Occurrences

kind-of:3.2.2 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ react-dev-utils:11.0.4
              └─ fork-ts-checker-webpack-plugin:4.1.6
                    └─ micromatch:3.1.10
                          └─ braces:2.3.2
                                └─ fill-range:4.0.0
                                      └─ is-number:3.0.0
                                            └─ kind-of:3.2.2
                                └─ snapdragon-node:2.1.1
                                      └─ snapdragon-util:3.0.1
                                            └─ kind-of:3.2.2
                          └─ snapdragon:0.8.2
                                └─ base:0.11.2
                                      └─ cache-base:1.0.1
                                            └─ has-value:1.0.0
                                                  └─ has-values:1.0.0
                                                        └─ is-number:3.0.0
                                                              └─ kind-of:3.2.2
                                            └─ to-object-path:0.3.0
                                                  └─ kind-of:3.2.2
                                      └─ class-utils:0.3.6
                                            └─ static-extend:0.1.2
                                                  └─ object-copy:0.1.0
                                                        └─ kind-of:3.2.2
                                └─ define-property:0.2.5
                                      └─ is-descriptor:0.1.6
                                            └─ is-accessor-descriptor:0.1.6
                                                  └─ kind-of:3.2.2
                                            └─ is-data-descriptor:0.1.4
                                                  └─ kind-of:3.2.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of express:4.17.1

Vulnerabilities

DepShield reports that this application's usage of express:4.17.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

---

Occurrences

express:4.17.1 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ express:4.17.1
        └─ gatsby-cli:4.3.0
              └─ gatsby-recipes:1.3.0
                    └─ express:4.17.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:4.0.0

Vulnerabilities

DepShield reports that this application's usage of kind-of:4.0.0 results in the following vulnerability(s):

• (CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

---

Occurrences

kind-of:4.0.0 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ react-dev-utils:11.0.4
              └─ fork-ts-checker-webpack-plugin:4.1.6
                    └─ micromatch:3.1.10
                          └─ snapdragon:0.8.2
                                └─ base:0.11.2
                                      └─ cache-base:1.0.1
                                            └─ has-value:1.0.0
                                                  └─ has-values:1.0.0
                                                        └─ kind-of:4.0.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash._reinterpolate:3.0.0

Vulnerabilities

DepShield reports that this application's usage of lodash._reinterpolate:3.0.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash._reinterpolate:3.0.0 is a transitive dependency introduced by the following direct dependency(s):

• gatsby-plugin-offline:5.3.0
        └─ workbox-build:4.3.1
              └─ lodash.template:4.5.0
                    └─ lodash._reinterpolate:3.0.0
                    └─ lodash.templatesettings:4.2.0
                          └─ lodash._reinterpolate:3.0.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.flatten:4.4.0

Vulnerabilities

DepShield reports that this application's usage of lodash.flatten:4.4.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.flatten:4.4.0 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ eslint-plugin-graphql:4.0.0
              └─ lodash.flatten:4.4.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.clonedeep:4.5.0

Vulnerabilities

DepShield reports that this application's usage of lodash.clonedeep:4.5.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.clonedeep:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ cache-manager:2.11.1
              └─ lodash.clonedeep:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.uniq:4.5.0

Vulnerabilities

DepShield reports that this application's usage of lodash.uniq:4.5.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.uniq:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ css-minimizer-webpack-plugin:2.0.0
              └─ cssnano:5.0.12
                    └─ cssnano-preset-default:5.1.8
                          └─ postcss-colormin:5.2.1
                                └─ caniuse-api:3.0.0
                                      └─ lodash.uniq:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.debounce:4.0.8

Vulnerabilities

DepShield reports that this application's usage of lodash.debounce:4.0.8 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.debounce:4.0.8 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ babel-preset-gatsby:2.3.0
              └─ @babel/plugin-transform-runtime:7.16.4
                    └─ babel-plugin-polyfill-corejs2:0.3.0
                          └─ @babel/helper-define-polyfill-provider:0.3.0
                                └─ lodash.debounce:4.0.8

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:5.1.0

Vulnerabilities

DepShield reports that this application's usage of kind-of:5.1.0 results in the following vulnerability(s):

• (CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

---

Occurrences

kind-of:5.1.0 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ react-dev-utils:11.0.4
              └─ fork-ts-checker-webpack-plugin:4.1.6
                    └─ micromatch:3.1.10
                          └─ snapdragon:0.8.2
                                └─ define-property:0.2.5
                                      └─ is-descriptor:0.1.6
                                            └─ kind-of:5.1.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.isstring:4.0.1

Vulnerabilities

DepShield reports that this application's usage of lodash.isstring:4.0.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.isstring:4.0.1 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ gatsby-cli:4.3.0
              └─ gatsby-recipes:1.3.0
                    └─ contentful-management:7.45.5
                          └─ contentful-sdk-core:6.10.4
                                └─ lodash.isstring:4.0.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of q:1.5.1

Vulnerabilities

DepShield reports that this application's usage of q:1.5.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

---

Occurrences

q:1.5.1 is a transitive dependency introduced by the following direct dependency(s):

• gatsby-plugin-sharp:4.3.0
        └─ svgo:1.3.2
              └─ coa:2.0.2
                    └─ q:1.5.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of ansi-html:0.0.7

Vulnerabilities

DepShield reports that this application's usage of ansi-html:0.0.7 results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2021-23424] This affects all versions of package ansi-html. If an attacker provides a malici...

---

Occurrences

ansi-html:0.0.7 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ @gatsbyjs/webpack-hot-middleware:2.25.2
              └─ ansi-html:0.0.7
        └─ @pmmmwh/react-refresh-webpack-plugin:0.4.3
              └─ ansi-html:0.0.7

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of trim:0.0.1

Vulnerabilities

DepShield reports that this application's usage of trim:0.0.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

trim:0.0.1 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ gatsby-cli:4.3.0
              └─ gatsby-recipes:1.3.0
                    └─ remark-parse:6.0.3
                          └─ trim:0.0.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 5.3) Vulnerability due to usage of ws:7.4.5

Vulnerabilities

DepShield reports that this application's usage of ws:7.4.5 results in the following vulnerability(s):

• (CVSS 5.3) [CVE-2021-32640] ws is an open source WebSocket client and server library for Node.js. A speciall...

---

Occurrences

ws:7.4.5 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ eslint-plugin-graphql:4.0.0
              └─ graphql-config:3.4.1
                    └─ @graphql-tools/url-loader:6.10.1
                          └─ subscriptions-transport-ws:0.9.19
                                └─ ws:7.4.5
                          └─ ws:7.4.5
        └─ gatsby-cli:4.3.0
              └─ gatsby-recipes:1.3.0
                    └─ ws:7.4.5
        └─ socket.io:3.1.2
              └─ engine.io:4.1.1
                    └─ ws:7.4.5
        └─ socket.io-client:3.1.3
              └─ engine.io-client:4.1.4
                    └─ ws:7.4.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.memoize:4.1.2

Vulnerabilities

DepShield reports that this application's usage of lodash.memoize:4.1.2 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.memoize:4.1.2 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ css-minimizer-webpack-plugin:2.0.0
              └─ cssnano:5.0.12
                    └─ cssnano-preset-default:5.1.8
                          └─ postcss-colormin:5.2.1
                                └─ caniuse-api:3.0.0
                                      └─ lodash.memoize:4.1.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.map:4.6.0

Vulnerabilities

DepShield reports that this application's usage of lodash.map:4.6.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.map:4.6.0 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ string-similarity:1.2.2
              └─ lodash.map:4.6.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.foreach:4.5.0

Vulnerabilities

DepShield reports that this application's usage of lodash.foreach:4.5.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

---

Occurrences

lodash.foreach:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ string-similarity:1.2.2
              └─ lodash.foreach:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.flattendeep:4.4.0

Vulnerabilities

DepShield reports that this application's usage of lodash.flattendeep:4.4.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.flattendeep:4.4.0 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ string-similarity:1.2.2
              └─ lodash.flattendeep:4.4.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.isplainobject:4.0.6

Vulnerabilities

DepShield reports that this application's usage of lodash.isplainobject:4.0.6 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.isplainobject:4.0.6 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ gatsby-cli:4.3.0
              └─ gatsby-recipes:1.3.0
                    └─ contentful-management:7.45.5
                          └─ contentful-sdk-core:6.10.4
                                └─ lodash.isplainobject:4.0.6
                          └─ lodash.isplainobject:4.0.6

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of http-proxy:1.18.1

Vulnerabilities

DepShield reports that this application's usage of http-proxy:1.18.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

http-proxy:1.18.1 is a transitive dependency introduced by the following direct dependency(s):

• gatsby:4.3.0
        └─ http-proxy:1.18.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}