Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

21 vulnerabilities (11 moderate, 6 high, 4 critical) #41

Closed
idimo opened this issue Jan 28, 2022 · 5 comments
Closed

21 vulnerabilities (11 moderate, 6 high, 4 critical) #41

idimo opened this issue Jan 28, 2022 · 5 comments

Comments

@idimo
Copy link

idimo commented Jan 28, 2022

What am I doing wrong?

node js 16.13.2 is installed in the system

image

@quer
Copy link
Owner

quer commented Jan 28, 2022

all shoud be as expected.
you just have som setting to show warnings.

what happens when you use the project ?

i do not offen do a clean install. but you are right it shows some vulnerabilities, from what i did not know.
i will see if there is any think i can do about that in the furture.

@quer
Copy link
Owner

quer commented Jan 28, 2022

A fast local fix, is to run npm audit fix and then remove the folder node_modules and file package-lock.json and then run npm install and then npm audit fix

Then there shoud only be one high think left. But by doing this, i cant ensure all work as it shoud. Will look into it.
The one that i have that is still not fixed is:

csv-parse  <4.4.6
Severity: high
Regular Expression Denial of Service in csv-parse - https://github.com/advisories/GHSA-582f-p4pg-xc74
fix available via `npm audit fix`
node_modules/steam/node_modules/csv-parse

1 high severity vulnerability

@idimo
Copy link
Author

idimo commented Jan 28, 2022

did as you said

A fast local fix, is to run npm audit fix and then remove the folder node_modules and file package-lock.json and then run npm install and then npm audit fix

the launch outputs this:

image

maybe there is a way to run this script in docker?

@SENPAY98K
Copy link

Don't audit fix, just delete everything then re-download the project again
run in npm install and ignore all those vulnerabilities... and you are good to go.

@quer
Copy link
Owner

quer commented Jan 29, 2022

i did have a small look, into the warnings. as the module Steam is archived. and will not have any other updates. i cant fix all the warning. if you use npm audit fix it will just not work. it will remove the warning. but then the npm steam module, will not work.

@quer quer closed this as completed Jan 29, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants