Skip to content

Upgrade ESLint dependencies to fix "high severity security vulnerabilities" #8663

Closed
Closed
Upgrade ESLint dependencies to fix "high severity security vulnerabilities"#8663
Labels
issue: proposalneeds triage

Description

@phoqe
phoqe
opened on Mar 16, 2020

Is your proposal related to a problem?

When creating a new app with the default template it starts with two high severity security vulnerabilities in two of ESLints dependencies: acorn and minimist.

The releases 1.8.3 and lower of svjsl (JSLib-npm) are vulnerable, but only if installed in a developer environment. A patch has been released (v1.8.4) which fixes these vulnerabilities.

Identifiers:
CVE-2020-7598
SNYK-JS-ACORN-559469

Describe the solution you'd like

Upgrade minimist to version 1.2.2 or later.
Upgrade acorn to version 7.1.1 or later.

Describe alternatives you've considered

N/A

Additional context

Screen Shot 2020-03-16 at 10 42 11 AM

Screen Shot 2020-03-16 at 10 42 22 AM

Screen Shot 2020-03-16 at 10 42 34 AM

Activity

  1. phoqe
    added
    issue: proposal
    needs triage
    on Mar 16, 2020

  2. phoqe commented on Mar 16, 2020

    @phoqe
    phoqe
    on Mar 16, 2020
    Author

    #8656

  3. ashylen commented on Mar 18, 2020

    @ashylen
    ashylen
    on Mar 18, 2020

    These answers cover only part of the problem, what about minimist dependency?

  4. phoqe commented on Mar 18, 2020

    @phoqe
    phoqe
    on Mar 18, 2020
    Author

    @ashylen AFAIK there is no automated security fix for minimist out yet.

  5. azedine-batouche commented on Mar 18, 2020

    @azedine-batouche
    azedine-batouche
    on Mar 18, 2020

    npm i minimist

  6. Leired7 commented on Mar 18, 2020

    @Leired7
    Leired7
    on Mar 18, 2020

    Hi,

    npm i minimist doesn't take away my vulnerability... : ( Is there any other way to perform the manual review?

    Thank you

  7. weigruf commented on Mar 19, 2020

    @weigruf
    weigruf
    on Mar 19, 2020

    I tried with npm-force-resolutions, to manually enforce the version of minimist to 1.2.3, that fixes it but it looks like it breaks webpack of other npm-scripts (e.g: when running Jest tests).

    npm i minimist & react-scripts": "^3.4.0 didn't help either.

  8. onpaws commented on Mar 19, 2020

    @onpaws
    onpaws
    on Mar 19, 2020

    Yarn users should be able to work around this using by adding the following to package.json:

    "resolutions": {
    "minimist": "^1.2.2"
  },

    At least for my case this satisfied GitHub's automated security bot.

  9. weigruf commented on Mar 19, 2020

    @weigruf
    weigruf
    on Mar 19, 2020

    With npm I tried "resolutions":` { "minimist": "^1.2.5" },
    and the following npm-script: "preinstall": "npx npm-force-resolutions" but as mentioned earlier it broke webpack of other npm-scripts (e.g: when running Jest tests).

  10. phoqe commented on Mar 19, 2020

    @phoqe
    phoqe
    on Mar 19, 2020
    Author

    If anyone finds a working fix, please create a pull request.

  11. weigruf commented on Mar 19, 2020

    @weigruf
    weigruf
    on Mar 19, 2020

    A temporary solution.

    Adding:

    • "minimist": "^1.2.5" in the devDependencies
    • "resolutions": { "minimist": "^1.2.5" }
    • "preinstall": "npx npm-force-resolutions" (npm-script)

    in the package.json and running npm i fixed it for me temporarily.

    Of course, you will need to test your affected app(s) (there is a npm ERR! invalid: minimist@1.2.5 error for the mkdirp@0.5.1).

  12. tonix-tuft commented on Mar 22, 2020

    @tonix-tuft
    tonix-tuft
    on Mar 22, 2020

    I also get the minimist vulnerability warning as of today:

    $ npm audit
                                                                                
                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.2.1 <1.0.0 || >=1.2.3                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @babel/cli [dev]                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @babel/cli > chokidar > fsevents > node-pre-gyp > mkdirp >   │
│               │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.2.1 <1.0.0 || >=1.2.3                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ webpack [dev]                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ webpack > watchpack > chokidar > fsevents > node-pre-gyp >   │
│               │ mkdirp > minimist                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.2.1 <1.0.0 || >=1.2.3                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @babel/cli [dev]                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @babel/cli > chokidar > fsevents > node-pre-gyp > tar >      │
│               │ mkdirp > minimist                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.2.1 <1.0.0 || >=1.2.3                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ webpack [dev]                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ webpack > watchpack > chokidar > fsevents > node-pre-gyp >   │
│               │ tar > mkdirp > minimist                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.2.1 <1.0.0 || >=1.2.3                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @babel/cli [dev]                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @babel/cli > chokidar > fsevents > node-pre-gyp > rc >       │
│               │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.2.1 <1.0.0 || >=1.2.3                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ webpack [dev]                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ webpack > watchpack > chokidar > fsevents > node-pre-gyp >   │
│               │ rc > minimist                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 6 low severity vulnerabilities in 10258 scanned packages
  6 vulnerabilities require manual review. See the full report for details.

$ npm list minimist
my-project@1.2.3 /Users/my-user/repositories/my-project
├─┬ @babel/cli@7.8.4
│ └─┬ chokidar@2.1.8
│   └─┬ fsevents@1.2.11
│     └─┬ node-pre-gyp@0.14.0
│       ├─┬ mkdirp@0.5.1
│       │ └── minimist@0.0.8 
│       └─┬ rc@1.2.8
│         └── minimist@1.2.0 
├─┬ @babel/core@7.9.0
│ └─┬ json5@2.1.2
│   └── minimist@1.2.5  deduped
├─┬ babel-loader@8.1.0
│ ├─┬ loader-utils@1.4.0
│ │ └─┬ json5@1.0.1
│ │   └── minimist@1.2.5  deduped
│ └─┬ mkdirp@0.5.3
│   └── minimist@1.2.5  deduped
├── minimist@1.2.5 
└─┬ webpack-cli@3.3.11
  └─┬ loader-utils@1.2.3
    └─┬ json5@1.0.1
      └── minimist@1.2.5  deduped

  13. michael-reeves commented on Mar 27, 2020

    @michael-reeves
    michael-reeves
    on Mar 27, 2020

    The acorn issue appears to come from jest@24.9.0. It is nested down in jsdom, which appears have been upgraded as of jest@25.2.3

  14. Tawfeekamr commented on Jun 3, 2020

    @Tawfeekamr
    Tawfeekamr
    on Jun 3, 2020

    You need to locate where minimalist used and update the package.json inside node_modules folder, Then the error gone!

    The problem is there are some of my modules using minimalist! all node packages using another package and have their own package.json.

    I fixed the issue by:

    npm audit

    then I see the result (for example yargs-parser package):

    image

    I locate the path in CMD and update package.json for yargs-parser inside the node modules folder and update the patch of the module then inside the folder I run: npm install; Then the error gone!

  15. tombrowndev commented on Jun 30, 2020

    @tombrowndev
    tombrowndev
    on Jun 30, 2020

    Are there any updates? Is there an automated way to fix this yet with npm audit fix?

  16. AndresHMosqueda commented on Aug 5, 2020

    @AndresHMosqueda
    AndresHMosqueda
    on Aug 5, 2020

    How can this be fixed?

    I tried by deleting node/modules and package-lock.json and do a fresh npm install but I have the same issue, any feedback is really appreciated.

    IMG_7205
    IMG_7200

  17. gaearon commented on Feb 18, 2021

    @gaearon
    gaearon
    on Feb 18, 2021
    Contributor

    There was never any real vulnerability here, but this appears solved regardless so I'm closing.

  18. gaearon
    closed this as completedon Feb 18, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    issue: proposalneeds triage

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions