As part of T290248: Security Readiness Review For Campaigns Registration System, some packages with vulnerabilities have been identified. Since they are only used in the development environment, the risk level is not high. So let's update the ones that are not complicated to do so, and note the ones that are to be addressed separately.
Acceptance Criteria
- Update packages listed below if doing so won't compatibility issues
- If some of the newer versions contain breaking changes and will hence be difficult to update, create a separate task for it.
As reported via npm audit:
| Package | Version | Vuln Desc | Vuln URL | Service | Risk |
|---|---|---|---|---|---|
| grunt | 1.5.3 | Race Condition in Grunt | advisory link | npm audit | high |
As reported via scan.sh:
| Vulnerability | Package | Notes | Service | Remediation | Risk |
|---|---|---|---|---|---|
| CVE-2021-44906 | minimist | current: <1.2.6; fixed in: 1.2.6 | scan | [see details within advisory links] | critical |
| CVE-2021-23343 | path-parse | current: <1.0.7; fixed in: 1.0.7 | scan | [see details within advisory links] | medium |
| CVE-2020-7753 | trim | current: <0.0.3; fixed in: 0.0.3 | scan | [see details within advisory links] | high |
| CVE-2021-33623 | trim-newlines | current: <3.0.1; fixed in: 3.0.1 | scan | [see details within advisory links] | high |
| CVE-2021-23566 | nanoid | current: >=3.0.0-<3.1.31; fixed in: 3.1.31 | scan | [see details within advisory links] | medium |
| CVE-2021-3807 | ansi-regex | current: >=5.0.0-<5.0.1; fixed in: 5.0.1 | scan | [see details within advisory links] | high |