NPM Audit - 17 high vulnerabilities for solid-server 5.8.5 #1821

Activity

1. msbachler commented on Aug 28, 2025

   

   msbachler

   on Aug 28, 2025

   Last edited by msbachler

   Author

   More actions

   It is now 2 Critical and 10 high. Any chance of updating the packages?
2. bourgeoa commented on Aug 28, 2025

   

   bourgeoa

   on Aug 28, 2025

   Member

   More actions

   Lots of works is going on in Solid managed dependencencies SolidOS and Rdflib.
   I hope it will soon solve your University concerns.

   Help is also deeply needed.

   Cc @timea-solid
3. bourgeoa commented on Nov 7, 2025

   

   bourgeoa

   on Nov 7, 2025

   Last edited by bourgeoa

   Member

   More actions

   @msbachler

   The new npm version solid-server@5.8.8 as no critical nor high vulnerabilities.

   There only one remaining vulnerability

   # npm audit report
   
   bootstrap  3.1.1 - 3.4.1
   Severity: moderate
   Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components - https://github.com/advisories/GHSA-q58r-hwc8-rm9j
   Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes - https://github.com/advisories/GHSA-vxmc-5x29-h64v
   fix available via `npm audit fix --force`
   Will install bootstrap@5.3.8, which is a breaking change
   node_modules/bootstrap
   
   

   the reason this one is not resolve is due to Boostrap licence.
   Bootstrap is not directly used but only bootstrap CSS
4. msbachler commented on Nov 10, 2025

   

   msbachler

   on Nov 10, 2025

   Author

   More actions

   That is great news. Thank you so much. I will update now!