Security Review Summary - T288768 - 2021-12-06

Overall, the current vendor code under consideration...
with an overall risk rating of: medium

Vuex 4

General Security Information

Vulnerable Packages
13 high and 1 critical vulnerability found in dev dependencies
Risk: medium
Dev dependencies can be exploited, but this was lowered from high risk since the dependencies are dev only

Outdated Packages
As reported via npm outdated:

Risk: low.

Static Analysis Results
Running semgrep with the OWASP Top 10 policy and general CI had zero findings. Using NJSscan did return a couple items,
but nothing of note.

Risk: low.

General Security Issues

1. There is an open PR to the conventional-changelog package to update the vulnerable handlebars version, but it's been open since May with no action
2. There are a high number of outdated packages, but none seem to have any noted vulnerabilities to be concerned about

Hey @Catrope (and your current director, @dr0ptp4kt, as recorded in Namely) -

We've entered this as an accepted medium risk into the Security-Team's risk registry, per @Mstyles's findings above. If you have any questions, please first refer to our current (internal) risk management framework. If any risk treatment or mitigation plans are to be created, please feel free to follow up here with that information. Thanks.