๐ป My Github account statistics:
๐ข I'm currently working at the WebbyLab
๐ซ How to reach me:
- telegram: @dimapustovit
- email: [email protected]
- skype: dima.pustovit
jira and confluence command line interface
License: MIT License
๐ป My Github account statistics:
๐ข I'm currently working at the WebbyLab
๐ซ How to reach me:
Is your feature request related to a problem? Please describe.
Integrate base-api-client instead direct axios calls
https://www.npmjs.com/package/base-api-client
Is your feature request related to a problem? Please describe.
Add alias (last month, last week...)
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in HEAD commit: dd0a7d4da9a8000bf0c587c216284c759a38b136
Found in base branch: master
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.
Publish Date: 2022-09-14
URL: CVE-2022-2900
Base Score Metrics:
Step up your Open Source Security Game with Mend here
HTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.7.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/follow-redirects/package.json
Dependency Hierarchy:
Found in HEAD commit: dd0a7d4da9a8000bf0c587c216284c759a38b136
Found in base branch: master
Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.
Publish Date: 2022-02-09
URL: CVE-2022-0536
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536
Release Date: 2022-02-09
Fix Resolution: follow-redirects - 1.14.8
Step up your Open Source Security Game with Mend here
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in HEAD commit: dd0a7d4da9a8000bf0c587c216284c759a38b136
Found in base branch: master
Cross-site Scripting (XSS) - Generic in GitHub repository ionicabizau/parse-url prior to 7.0.0.
Publish Date: 2022-06-27
URL: CVE-2022-2217
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/4e046c63-b1ca-4bcc-b418-29796918a71b/
Release Date: 2022-06-27
Fix Resolution: parse-url - 6.0.1
Step up your Open Source Security Game with Mend here
Is your feature request related to a problem? Please describe.
Now issues are sorted by id.
Describe the solution you'd like
Sort issues by last transition to development
Such sorting should be optional (or order
field included into export handler, so log handler wont sort any tasks)
Describe alternatives you've considered
Discover ability to split periods by transitions
Parse paths (local paths, urls: ssh/git/etc)
Library home page: https://registry.npmjs.org/parse-path/-/parse-path-4.0.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-path/package.json
Dependency Hierarchy:
Found in HEAD commit: dd0a7d4da9a8000bf0c587c216284c759a38b136
Found in base branch: master
Authorization Bypass Through User-Controlled Key in GitHub repository ionicabizau/parse-path prior to 5.0.0.
Publish Date: 2022-06-28
URL: CVE-2022-0624
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0624
Release Date: 2022-06-28
Fix Resolution: parse-path - 5.0.0
Step up your Open Source Security Game with Mend here
Promise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.21.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/semantic-release-telegram/node_modules/axios/package.json
Dependency Hierarchy:
Promise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.25.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/axios/package.json
Dependency Hierarchy:
Found in HEAD commit: dd0a7d4da9a8000bf0c587c216284c759a38b136
Found in base branch: master
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository axios/axios prior to 0.26.
Publish Date: 2022-05-03
URL: CVE-2022-1214
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/ef7b4ab6-a3f6-4268-a21a-e7104d344607/
Release Date: 2022-05-03
Fix Resolution: axios - v0.26.0
Step up your Open Source Security Game with WhiteSource here
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in HEAD commit: dd0a7d4da9a8000bf0c587c216284c759a38b136
Found in base branch: master
Regular Expression Denial of Service (ReDoS) in ionicabizau/parse-url before 8.0.0.
It allows cause a denial of service when calling function parse-url
Publish Date: 2022-07-04
URL: WS-2022-0237
Base Score Metrics:
Step up your Open Source Security Game with Mend here
a package manager for JavaScript
Library home page: https://registry.npmjs.org/npm/-/npm-8.4.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/npm/package.json
Dependency Hierarchy:
Found in HEAD commit: dd0a7d4da9a8000bf0c587c216284c759a38b136
Found in base branch: master
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces
, --workspace=<name>
). Anyone who has run npm pack
or npm publish
inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.
Publish Date: 2022-06-13
URL: CVE-2022-29244
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-hj9c-8jmm-8c52
Release Date: 2022-06-13
Fix Resolution (npm): 8.11.0
Direct dependency fix Resolution (semantic-release): 19.0.3
Step up your Open Source Security Game with Mend here
Issue Description
include last date into log time handler:
jira log --from 01-05-21 --to 01-06-21
should match whole May
Regular expression for matching ANSI escape codes
Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/npm/node_modules/string-width/node_modules/ansi-regex/package.json
Dependency Hierarchy:
Regular expression for matching ANSI escape codes
Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/npm/node_modules/cli-table3/node_modules/ansi-regex/package.json
Dependency Hierarchy:
Found in HEAD commit: 9b797f877c39ef1c3817e76133983c4332052454
Found in base branch: master
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
Publish Date: 2021-09-17
URL: CVE-2021-3807
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/
Release Date: 2021-09-17
Fix Resolution (ansi-regex): 3.0.1
Direct dependency fix Resolution (semantic-release): 19.0.3
Fix Resolution (ansi-regex): 5.0.1
Direct dependency fix Resolution (semantic-release): 19.0.3
Step up your Open Source Security Game with Mend here
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz
Dependency Hierarchy:
Found in HEAD commit: a9b492bbdbcf1295abd8dc397e187df7dccb74ef
Found in base branch: master
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Publish Date: 2022-03-17
URL: CVE-2021-44906
Base Score Metrics:
Type: Upgrade version
Release Date: 2022-03-17
Fix Resolution (minimist): 1.2.6
Direct dependency fix Resolution (html-to-text): 8.1.1
Step up your Open Source Security Game with Mend here
simple, flexible, fun test framework
Library home page: https://registry.npmjs.org/mocha/-/mocha-9.2.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mocha/package.json
Dependency Hierarchy:
Found in base branch: master
There is regular Expression Denial of Service (ReDoS) vulnerability in mocha.
It allows cause a denial of service when stripping crafted invalid function definition from strs.
Publish Date: 2021-09-18
URL: WS-2021-0638
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/1d8a3d95-d199-4129-a6ad-8eafe5e77b9e/
Release Date: 2021-09-18
Fix Resolution: https://github.com/mochajs/mocha/commit/61b4b9209c2c64b32c8d48b1761c3b9384d411ea
Step up your Open Source Security Game with Mend here
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in HEAD commit: dd0a7d4da9a8000bf0c587c216284c759a38b136
Found in base branch: master
File Protocol Spoofing in parse-url before 8.0.0 can lead to attacks, such as XSS, Arbitrary Read/Write File, and Remote Code Execution.
Publish Date: 2022-06-30
URL: WS-2022-0238
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/52060edb-e426-431b-a0d0-e70407e44f18/
Release Date: 2022-06-30
Fix Resolution: parse-url - 8.0.0
Step up your Open Source Security Game with Mend here
Promise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.25.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/axios/package.json
Dependency Hierarchy:
Found in base branch: master
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
Publish Date: 2023-11-08
URL: CVE-2023-45857
Base Score Metrics:
Step up your Open Source Security Game with Mend here
Is your feature request related to a problem? Please describe.
Allow switch between created and updated dates
HTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/follow-redirects/package.json
Dependency Hierarchy:
Found in base branch: master
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
Publish Date: 2024-01-02
URL: CVE-2023-26159
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-26159
Release Date: 2024-01-02
Fix Resolution (follow-redirects): 1.15.4
Direct dependency fix Resolution (base-api-client): 1.5.9
Step up your Open Source Security Game with Mend here
Extract the non-magic parent path from a glob string.
Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/glob-parent/package.json
Dependency Hierarchy:
Found in HEAD commit: 9b797f877c39ef1c3817e76133983c4332052454
Found in base branch: master
The package glob-parent before 6.0.1 are vulnerable to Regular Expression Denial of Service (ReDoS)
Publish Date: 2021-06-22
URL: CVE-2021-35065
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-cj88-88mr-972w
Release Date: 2021-06-22
Fix Resolution (glob-parent): 6.0.1
Direct dependency fix Resolution (eslint): 8.0.0
Step up your Open Source Security Game with Mend here
Automated semver compliant package publishing
Library home page: https://registry.npmjs.org/semantic-release/-/semantic-release-19.0.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/semantic-release/package.json
Dependency Hierarchy:
Found in HEAD commit: 9b797f877c39ef1c3817e76133983c4332052454
Found in base branch: master
semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI
. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials. Users are advised to upgrade. Users unable to upgrade should ensure that secrets that do not contain characters that are excluded from encoding with encodeURI
when included in a URL are already masked properly.
Publish Date: 2022-06-09
URL: CVE-2022-31051
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-x2pg-mjhr-2m5x
Release Date: 2022-06-09
Fix Resolution: 19.0.3
Step up your Open Source Security Game with Mend here
A tiny (108 bytes), secure URL-friendly unique string ID generator
Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.1.25.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nanoid/package.json
Dependency Hierarchy:
Found in base branch: master
The package nanoid before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
Publish Date: 2022-01-14
URL: CVE-2021-23566
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23566
Release Date: 2022-01-14
Fix Resolution: nanoid - 3.1.31
Step up your Open Source Security Game with WhiteSource here
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in HEAD commit: dd0a7d4da9a8000bf0c587c216284c759a38b136
Found in base branch: master
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.
Publish Date: 2022-06-27
URL: CVE-2022-2216
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/505a3d39-2723-4a06-b1f7-9b2d133c92e1/
Release Date: 2022-06-27
Fix Resolution: parse-url - 6.0.1
Step up your Open Source Security Game with Mend here
HTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/follow-redirects/package.json
Dependency Hierarchy:
Found in base branch: master
follow-redirects is an open source, drop-in replacement for Node's http
and https
modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Publish Date: 2024-03-14
URL: CVE-2024-28849
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-cxjh-pqwp-8mfp
Release Date: 2024-03-14
Fix Resolution: follow-redirects - 1.15.6
Step up your Open Source Security Game with Mend here
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in HEAD commit: dd0a7d4da9a8000bf0c587c216284c759a38b136
Found in base branch: master
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0.
Publish Date: 2022-06-27
URL: CVE-2022-0722
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/2490ef6d-5577-4714-a4dd-9608251b4226
Release Date: 2022-06-27
Fix Resolution: parse-url - 6.0.1
Step up your Open Source Security Game with Mend here
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in HEAD commit: dd0a7d4da9a8000bf0c587c216284c759a38b136
Found in base branch: master
Cross-Site Scripting via Improper Input Validation (parser differential) in parse-url before 8.0.0.
Through this vulnerability, an attacker is capable to execute malicious JS codes.
Publish Date: 2022-07-02
URL: WS-2022-0239
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/5fa3115f-5c97-4928-874c-3cc6302e154e
Release Date: 2022-07-02
Fix Resolution: parse-url - 8.0.0
Step up your Open Source Security Game with Mend here
A light-weight module that brings window.fetch to node.js
Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/danger/node_modules/node-fetch/package.json
Dependency Hierarchy:
Found in base branch: master
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Publish Date: 2022-01-16
URL: CVE-2022-0235
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-r683-j2x4-v87g
Release Date: 2022-01-16
Fix Resolution: node-fetch - 2.6.7,3.1.1
Step up your Open Source Security Game with WhiteSource here
Allow to specify sprints on export log.
Please follow the general troubleshooting steps first:
Is your feature request related to a problem? Please describe.
Add --dry-run option for 'unsafe' use-cases
This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
Warning
These dependencies are deprecated:
These updates are currently rate-limited. Click on a checkbox below to force their creation now.
base-api-client
, myrmidon
)@babel/cli
, @babel/core
, @babel/node
, @babel/plugin-proposal-class-properties
, @babel/plugin-proposal-decorators
, @babel/plugin-proposal-object-rest-spread
, @babel/plugin-proposal-optional-chaining
, @babel/preset-env
, @babel/runtime
, @semantic-release/changelog
, chai
, chance
, eslint-config-incredible
, eslint-plugin-censor
, eslint-plugin-import
, eslint-plugin-no-secrets
, eslint-plugin-node
, eslint-plugin-regexp
, eslint-plugin-security
, eslint-plugin-sonarjs
, fs-extra
, jscpd
, lockfile-lint
, mocha
, mocha-junit-reporter
, node-package-tester
, semantic-release-telegram
, winston-array-transport
)These updates await pending status checks. To force their creation now, click the checkbox below.
These updates have all been created already. Click a checkbox below to force a retry/rebase of any.
@commitlint/cli
, @commitlint/lint
, babel-plugin-module-resolver
, chai
, conventional-changelog-eslint
, danger
, dotenv
, eslint
, eslint-plugin-markdown
, eslint-plugin-mocha
, eslint-plugin-no-secrets
, eslint-plugin-promise
, eslint-plugin-regexp
, eslint-plugin-security
, eslint-plugin-sonarjs
, eslint-plugin-unicorn
, fs-extra
, husky
, jscpd
, mocha
, nyc
, semantic-release
).github/workflows/codeql.yml
actions/checkout v3
github/codeql-action v2
github/codeql-action v2
github/codeql-action v2
.github/workflows/npt.yml
actions/checkout v2
actions/setup-node v2
actions/setup-node v2
package.json
base-api-client 1.5.8
chalk 4.1.2
dayjs 1.10.7
fs-extra 10.0.0
html-to-text 8.1.0
inquirer 8.2.0
ms 2.1.3
myrmidon 1.7.2
triple-beam 1.3.0
uuid 8.3.2
winston 3.6.0
yargs 17.3.1
@babel/cli ^7.17.0
@babel/core ^7.17.0
@babel/node ^7.16.8
@babel/plugin-proposal-class-properties ^7.16.7
@babel/plugin-proposal-decorators ^7.17.0
@babel/plugin-proposal-object-rest-spread ^7.16.7
@babel/plugin-proposal-optional-chaining ^7.16.7
@babel/polyfill ^7.12.1
@babel/preset-env ^7.16.11
@babel/runtime ^7.17.0
@commitlint/cli ^13.2.1
@commitlint/lint ^13.2.0
@semantic-release/changelog ^6.0.1
@semantic-release/git ^10.0.1
babel-plugin-module-resolver ^4.1.0
babel-plugin-shebang ^1.0.0
chai ^4.3.6
chance ^1.1.8
cls-hooked ^4.2.2
conventional-changelog-eslint ^3.0.9
coveralls ^3.1.1
danger ^10.9.0
dotenv ^10.0.0
eslint ^7.32.0
eslint-config-incredible ^2.4.1
eslint-plugin-censor ^1.5.2
eslint-plugin-import ^2.25.4
eslint-plugin-markdown ^2.2.1
eslint-plugin-mocha ^9.0.0
eslint-plugin-no-secrets ^0.8.9
eslint-plugin-node ^11.1.0
eslint-plugin-promise ^5.2.0
eslint-plugin-regexp ^1.5.1
eslint-plugin-scanjs-rules ^0.2.1
eslint-plugin-security ^1.4.0
eslint-plugin-sonarjs ^0.11.0
eslint-plugin-unicorn ^36.0.0
fs-extra ^10.0.0
husky ^7.0.4
jscpd ^3.4.5
json-query ^2.2.2
lockfile-lint ^4.6.2
mocha ^9.2.0
mocha-junit-reporter ^2.0.2
mock-stdin ^1.0.0
node-package-tester ^1.3.4
nyc ^15.1.0
semantic-release ^19.0.5
semantic-release-telegram ^1.6.0
test-console ^2.0.0
winston-array-transport ^1.1.7
node >=10
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in base branch: master
Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0.
Publish Date: 2022-09-15
URL: CVE-2022-3224
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3224
Release Date: 2022-09-15
Fix Resolution: parse-url - 8.1.0
Step up your Open Source Security Game with Mend here
Regular expression for matching semver versions
Library home page: https://registry.npmjs.org/semver-regex/-/semver-regex-3.1.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/semver-regex/package.json
Dependency Hierarchy:
Found in HEAD commit: dd0a7d4da9a8000bf0c587c216284c759a38b136
Found in base branch: master
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
Publish Date: 2022-06-02
URL: CVE-2021-43307
Base Score Metrics:
Type: Upgrade version
Origin: https://research.jfrog.com/vulnerabilities/semver-regex-redos-xray-211349/
Release Date: 2022-06-02
Fix Resolution (semver-regex): 3.1.4
Direct dependency fix Resolution (semantic-release): 19.0.3
Step up your Open Source Security Game with Mend here
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in HEAD commit: dd0a7d4da9a8000bf0c587c216284c759a38b136
Found in base branch: master
Cross-site Scripting (XSS) - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0.
Publish Date: 2022-06-27
URL: CVE-2022-2218
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/024912d3-f103-4daf-a1d0-567f4d9f2bf5/
Release Date: 2022-06-27
Fix Resolution: parse-url - 6.0.1
Step up your Open Source Security Game with Mend here
This issue provides visibility into Lalaps updates and their statuses.
decode-uri-component vulnerable to Denial of Service (DoS)
Library: decode-uri-component
Affected versions: <=0.2.0
Severity: low
Root Libraries:
danger
minimatch ReDoS vulnerability
Library: minimatch
Affected versions: <3.0.5
Severity: high
โ๏ธ #116
Root Libraries:
mocha
#116Last Updated: 01 Dec 2022, at 01:35 UTC
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.