Finding from security review:
We need to fix the folllowing vulnerabilities on the npm dependencies:
Vulnerable Packages - Production
| Vulnerability | Package | Notes | Service | Risk |
|---|---|---|---|---|
| Prototype Pollution | minimist <0.2.1, >=1.0.0 <1.2.3 | N/A | npm | low |
Update: There is only one remainder dependency vulnerability which is an upstream issue tracked down to service-runner, the table was updated to reflect that.
| Subject | Author | Repo | Branch | Lines +/- | |
|---|---|---|---|---|---|
| Fix npm dependencies automatically with audit | MSantos | mediawiki/services/push-notifications | master | +342 -55 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | sbassett | T251190 Security Request For Service - Push Notifications | |||
| Resolved | • Mholloway | T262936 Enable app push notifications in production | |||
| Resolved | sbassett | T246712 Security Readiness Review for push notifications infrastructure | |||
| Resolved | MSantos | T262648 Fix known npm dependency vulnerabilities on push-notifications |
After a quick npm audit --fix run it looks like most of the vulnerabilities can be fixed automatically and tests run fine after the fixes.
The only one that's tricky is related to:
https://github.com/wikimedia/service-runner/pull/231
Change 627427 had a related patch set uploaded (by MSantos; owner: MSantos):
[mediawiki/services/push-notifications@master] Fix npm dependencies automatically with audit
Change 627427 merged by jenkins-bot:
[mediawiki/services/push-notifications@master] Fix npm dependencies automatically with audit
@Jgiannelos or @MSantos Would you mind updating the table in the task description with which deps have been updated and which are blocked on service-runner updates?