[stable29] Fix npm audit #992

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

nextcloud-command wants to merge 1 commit into stable29 from automated/noid/stable29-fix-npm-audit

Contributor

nextcloud-command commented Apr 20, 2025 •

edited

Loading

Audit report

This audit fix resolves 7 of the total 14 vulnerabilities found in your project.

Updated dependencies

@nextcloud/dialogs
@nextcloud/vite-config
@vitejs/plugin-vue2
esbuild
rollup-plugin-esbuild-minify
vite
vue-resize

Fixed vulnerabilities

@nextcloud/dialogs #

Caused by vulnerable dependency:
Affected versions: >=4.2.0-beta.1
Package usage:
- node_modules/@nextcloud/dialogs

@nextcloud/vite-config #

Caused by vulnerable dependency:
- @vitejs/plugin-vue2
Affected versions: <=1.5.3
Package usage:
- node_modules/@nextcloud/vite-config

@vitejs/plugin-vue2 #

Caused by vulnerable dependency:
- vue
Affected versions: *
Package usage:
- node_modules/@vitejs/plugin-vue2

esbuild #

esbuild enables any website to send any requests to the development server and read the response
Severity: moderate (CVSS 5.3)
Reference: GHSA-67mh-4wv8-2f99
Affected versions: <=0.24.2
Package usage:
- node_modules/esbuild
- node_modules/vite/node_modules/esbuild

rollup-plugin-esbuild-minify #

Caused by vulnerable dependency:
- esbuild
Affected versions: <=1.2.0
Package usage:
- node_modules/rollup-plugin-esbuild-minify

vite #

Caused by vulnerable dependency:
- esbuild
Affected versions: 0.11.0 - 6.1.5
Package usage:
- node_modules/vite

vue-resize #

Caused by vulnerable dependency:
- vue
Affected versions: 0.4.0 - 1.0.1
Package usage:
- node_modules/vue-resize

nextcloud-command added 3. to review dependencies labels


          fix(deps): Fix npm audit

955548f

Signed-off-by: GitHub <noreply@github.com>

nextcloud-command force-pushed the automated/noid/stable29-fix-npm-audit branch from 61d10bf to 955548f Compare

April 27, 2025 03:44

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3. to review dependencies