pustovitdmytro/eslint-config-incredible

Pretty eslint config.

💻 My Github account statistics:

🏢 I'm currently working at the WebbyLab

📫 How to reach me:

• telegram: @dimapustovit
• email: [email protected]
• skype: dima.pustovit

eslint-config-incredible's Issues

CVE-2021-43307 (High) detected in semver-regex-3.1.3.tgz - autoclosed

CVE-2021-43307 - High Severity Vulnerability

Vulnerable Library - semver-regex-3.1.3.tgz

Regular expression for matching semver versions

Library home page: https://registry.npmjs.org/semver-regex/-/semver-regex-3.1.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/semver-regex/package.json

Dependency Hierarchy:

• semantic-release-19.0.2.tgz (Root Library)
  • find-versions-4.0.0.tgz
    • ❌ semver-regex-3.1.3.tgz (Vulnerable Library)

Found in HEAD commit: 1e18b6188d5b291d49ce564132948efa43897d04

Found in base branch: master

Vulnerability Details

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method

Publish Date: 2022-06-02

URL: CVE-2021-43307

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://research.jfrog.com/vulnerabilities/semver-regex-redos-xray-211349/

Release Date: 2022-06-02

Fix Resolution (semver-regex): 3.1.4

Direct dependency fix Resolution (semantic-release): 19.0.3

---

Step up your Open Source Security Game with Mend here

WS-2021-0638 (High) detected in mocha-9.2.0.tgz - autoclosed

WS-2021-0638 - High Severity Vulnerability

Vulnerable Library - mocha-9.2.0.tgz

simple, flexible, fun test framework

Library home page: https://registry.npmjs.org/mocha/-/mocha-9.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mocha/package.json

Dependency Hierarchy:

• ❌ mocha-9.2.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

There is regular Expression Denial of Service (ReDoS) vulnerability in mocha.
It allows cause a denial of service when stripping crafted invalid function definition from strs.

Publish Date: 2021-09-18

URL: WS-2021-0638

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-09-18

Fix Resolution: mocha - 10.1.0

---

Step up your Open Source Security Game with Mend here

CVE-2022-1214 (High) detected in axios-0.21.4.tgz - autoclosed

CVE-2022-1214 - High Severity Vulnerability

Vulnerable Library - axios-0.21.4.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.21.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • base-api-client-1.5.3.tgz
    • ❌ axios-0.21.4.tgz (Vulnerable Library)

Found in HEAD commit: 1e18b6188d5b291d49ce564132948efa43897d04

Found in base branch: master

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository axios/axios prior to 0.26.

Publish Date: 2022-05-03

URL: CVE-2022-1214

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/ef7b4ab6-a3f6-4268-a21a-e7104d344607/

Release Date: 2022-05-03

Fix Resolution: axios - v0.26.0

---

Step up your Open Source Security Game with WhiteSource here

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

• chore: update actions/checkout action to v4

Edited/Blocked

These updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox.

• chore: update actions/setup-node action to v3

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Chore: Update devDependencies (non-major) (@babel/cli, @babel/core, @babel/node, @babel/plugin-proposal-decorators, @babel/plugin-proposal-object-rest-spread, @babel/plugin-proposal-optional-chaining, @babel/preset-env, @babel/runtime, @commitlint/cli, @commitlint/lint, @semantic-release/changelog, chai, chance, danger, eslint, eslint-plugin-censor, eslint-plugin-import, eslint-plugin-markdown, eslint-plugin-mocha, eslint-plugin-regexp, eslint-plugin-security, eslint-plugin-sonarjs, fs-extra, husky, jscpd, lockfile-lint, mocha-junit-reporter, semantic-release-telegram, uuid)
• Upgrade: Update dependency @babel/eslint-parser to v7.22.15
• Chore: Update devDependencies (non-major) (major) (babel-plugin-module-resolver, conventional-changelog-eslint, eslint-plugin-unicorn, semantic-release)
• Chore: Lock file maintenance
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

github-actions

.github/workflows/codeql.yml

• actions/checkout v3
• github/codeql-action v2
• github/codeql-action v2
• github/codeql-action v2

.github/workflows/npt.yml

• actions/checkout v2
• actions/setup-node v2
• actions/setup-node v2

npm

package.json

• @babel/eslint-parser 7.17.0
• @babel/cli ^7.19.3
• @babel/core ^7.20.5
• @babel/node ^7.20.5
• @babel/plugin-proposal-class-properties ^7.18.6
• @babel/plugin-proposal-decorators ^7.20.5
• @babel/plugin-proposal-object-rest-spread ^7.20.2
• @babel/plugin-proposal-optional-chaining ^7.18.9
• @babel/polyfill ^7.12.1
• @babel/preset-env ^7.20.2
• @babel/runtime ^7.20.6
• @commitlint/cli ^17.3.0
• @commitlint/lint ^17.3.0
• @semantic-release/changelog ^6.0.2
• @semantic-release/git ^10.0.1
• babel-plugin-module-resolver ^4.1.0
• chai ^4.3.7
• chance ^1.1.9
• conventional-changelog-eslint ^3.0.9
• coveralls ^3.1.1
• danger ^11.0.2
• eslint ^8.8.0
• eslint-plugin-censor ^1.5.2
• eslint-plugin-import ^2.26.0
• eslint-plugin-markdown ^3.0.0
• eslint-plugin-mocha ^10.1.0
• eslint-plugin-no-secrets ^0.8.9
• eslint-plugin-node ^11.1.0
• eslint-plugin-promise ^6.1.1
• eslint-plugin-regexp ^1.11.0
• eslint-plugin-scanjs-rules ^0.2.1
• eslint-plugin-security ^1.5.0
• eslint-plugin-sonarjs ^0.17.0
• eslint-plugin-unicorn 45.0.2
• fs-extra ^11.1.0
• husky ^8.0.2
• jscpd ^3.5.3
• lockfile-lint ^4.9.6
• mocha ^10.2.0
• mocha-junit-reporter ^2.2.0
• node-package-tester ^1.3.6
• nyc ^15.1.0
• semantic-release ^19.0.5
• semantic-release-telegram ^1.6.0
• uuid ^9.0.0
• eslint >= 7
• eslint-plugin-censor >= 1
• eslint-plugin-import >= 2
• eslint-plugin-markdown >= 2
• eslint-plugin-mocha >= 8
• eslint-plugin-no-secrets >= 0
• eslint-plugin-node >= 11
• eslint-plugin-promise >= 5
• eslint-plugin-regexp >= 0
• eslint-plugin-scanjs-rules >= 0
• eslint-plugin-security >= 1
• eslint-plugin-sonarjs >= 0
• eslint-plugin-unicorn >= 32
• node >=10

---

• Check this box to trigger a request for Renovate to run again on this repository

Bug: drop more [1.7.0]

Issue Description
Drop plugin-more due to a lot of bugs.

Please follow the general troubleshooting steps first:

• I've searched on the issue tracker before creating one.
• I'm running latest package version.
• I'm ready to provide help with fix, if needed.

CVE-2022-0722 (High) detected in parse-url-6.0.0.tgz - autoclosed

CVE-2022-0722 - High Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1e18b6188d5b291d49ce564132948efa43897d04

Found in base branch: master

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0.

Publish Date: 2022-06-27

URL: CVE-2022-0722

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/2490ef6d-5577-4714-a4dd-9608251b4226

Release Date: 2022-06-27

Fix Resolution: parse-url - 6.0.1

---

Step up your Open Source Security Game with Mend here

CVE-2022-3224 (Medium) detected in parse-url-6.0.0.tgz - autoclosed

CVE-2022-3224 - Medium Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0.

Publish Date: 2022-09-15

URL: CVE-2022-3224

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3224

Release Date: 2022-09-15

Fix Resolution: parse-url - 8.1.0

---

Step up your Open Source Security Game with Mend here

Feature: add tests

Is your feature request related to a problem? Please describe.
Research possibility to validate configs

Bug: fix npt

add eslint legacy version to node-package-tester

WS-2022-0239 (Medium) detected in parse-url-6.0.0.tgz - autoclosed

WS-2022-0239 - Medium Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1e18b6188d5b291d49ce564132948efa43897d04

Found in base branch: master

Vulnerability Details

Cross-Site Scripting via Improper Input Validation (parser differential) in parse-url before 8.0.0.
Through this vulnerability, an attacker is capable to execute malicious JS codes.

Publish Date: 2022-07-02

URL: WS-2022-0239

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5fa3115f-5c97-4928-874c-3cc6302e154e

Release Date: 2022-07-02

Fix Resolution: parse-url - 8.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2022-2216 (High) detected in parse-url-6.0.0.tgz - autoclosed

CVE-2022-2216 - High Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1e18b6188d5b291d49ce564132948efa43897d04

Found in base branch: master

Vulnerability Details

Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.

Publish Date: 2022-06-27

URL: CVE-2022-2216

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/505a3d39-2723-4a06-b1f7-9b2d133c92e1/

Release Date: 2022-06-27

Fix Resolution: parse-url - 6.0.1

---

Step up your Open Source Security Game with Mend here

Feature: Add plugin for configs

Is your feature request related to a problem? Please describe.
Add plugins for configs:

• json
• yaml

nice to have:

• sort keys in package.json
• key spacing
• identaion

CVE-2022-0624 (High) detected in parse-path-4.0.3.tgz - autoclosed

CVE-2022-0624 - High Severity Vulnerability

Vulnerable Library - parse-path-4.0.3.tgz

Parse paths (local paths, urls: ssh/git/etc)

Library home page: https://registry.npmjs.org/parse-path/-/parse-path-4.0.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-path/package.json

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • parse-url-6.0.0.tgz
        • ❌ parse-path-4.0.3.tgz (Vulnerable Library)

Found in HEAD commit: 1e18b6188d5b291d49ce564132948efa43897d04

Found in base branch: master

Vulnerability Details

Authorization Bypass Through User-Controlled Key in GitHub repository ionicabizau/parse-path prior to 5.0.0.

Publish Date: 2022-06-28

URL: CVE-2022-0624

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0624

Release Date: 2022-06-28

Fix Resolution: parse-path - 5.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2021-35065 (High) detected in glob-parent-5.1.2.tgz - autoclosed

CVE-2021-35065 - High Severity Vulnerability

Vulnerable Library - glob-parent-5.1.2.tgz

Extract the non-magic parent path from a glob string.

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

• cli-7.17.0.tgz (Root Library)
  • chokidar-3.5.3.tgz
    • ❌ glob-parent-5.1.2.tgz (Vulnerable Library)

Found in HEAD commit: 1e18b6188d5b291d49ce564132948efa43897d04

Found in base branch: master

Vulnerability Details

The package glob-parent before 6.0.1 are vulnerable to Regular Expression Denial of Service (ReDoS)

Publish Date: 2021-06-22

URL: CVE-2021-35065

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cj88-88mr-972w

Release Date: 2021-06-22

Fix Resolution (glob-parent): 6.0.1

Direct dependency fix Resolution (@babel/cli): 7.17.3

---

Step up your Open Source Security Game with Mend here

CVE-2022-3517 (High) detected in minimatch-3.0.4.tgz - autoclosed

CVE-2022-3517 - High Severity Vulnerability

Vulnerable Library - minimatch-3.0.4.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/npm/node_modules/minimatch/package.json,/node_modules/minimatch/package.json

Dependency Hierarchy:

• eslint-8.8.0.tgz (Root Library)
  • ❌ minimatch-3.0.4.tgz (Vulnerable Library)

Found in HEAD commit: 1e18b6188d5b291d49ce564132948efa43897d04

Found in base branch: master

Vulnerability Details

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Publish Date: 2022-10-17

URL: CVE-2022-3517

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-17

Fix Resolution: minimatch - 3.0.5

---

Step up your Open Source Security Game with Mend here

CVE-2022-29244 (High) detected in npm-8.4.1.tgz - autoclosed

CVE-2022-29244 - High Severity Vulnerability

Vulnerable Library - npm-8.4.1.tgz

a package manager for JavaScript

Library home page: https://registry.npmjs.org/npm/-/npm-8.4.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/npm/package.json

Dependency Hierarchy:

• semantic-release-19.0.2.tgz (Root Library)
  • npm-9.0.0.tgz
    • ❌ npm-8.4.1.tgz (Vulnerable Library)

Found in HEAD commit: 1e18b6188d5b291d49ce564132948efa43897d04

Found in base branch: master

Vulnerability Details

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces, --workspace=<name>). Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

Publish Date: 2022-06-13

URL: CVE-2022-29244

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hj9c-8jmm-8c52

Release Date: 2022-06-13

Fix Resolution (npm): 8.11.0

Direct dependency fix Resolution (semantic-release): 19.0.3

---

Step up your Open Source Security Game with Mend here

Feature: split basic recommendations

Is your feature request related to a problem? Please describe.
Allow to use config without peerDependencies

WS-2022-0237 (High) detected in parse-url-6.0.0.tgz - autoclosed

WS-2022-0237 - High Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1e18b6188d5b291d49ce564132948efa43897d04

Found in base branch: master

Vulnerability Details

Regular Expression Denial of Service (ReDoS) in ionicabizau/parse-url before 8.0.0.
It allows cause a denial of service when calling function parse-url

Publish Date: 2022-07-04

URL: WS-2022-0237

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-07-04

Fix Resolution: parse-url - 8.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2022-2217 (Medium) detected in parse-url-6.0.0.tgz - autoclosed

CVE-2022-2217 - Medium Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1e18b6188d5b291d49ce564132948efa43897d04

Found in base branch: master

Vulnerability Details

Cross-site Scripting (XSS) - Generic in GitHub repository ionicabizau/parse-url prior to 7.0.0.

Publish Date: 2022-06-27

URL: CVE-2022-2217

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/4e046c63-b1ca-4bcc-b418-29796918a71b/

Release Date: 2022-06-27

Fix Resolution: parse-url - 6.0.1

---

Step up your Open Source Security Game with Mend here

CVE-2021-3807 (High) detected in ansi-regex-3.0.0.tgz, ansi-regex-5.0.0.tgz - autoclosed

CVE-2021-3807 - High Severity Vulnerability

Vulnerable Libraries - ansi-regex-3.0.0.tgz, ansi-regex-5.0.0.tgz

ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/npm/node_modules/string-width/node_modules/ansi-regex/package.json

Dependency Hierarchy:

• semantic-release-19.0.2.tgz (Root Library)
  • npm-9.0.0.tgz
    • npm-8.4.1.tgz
      • npmlog-6.0.0.tgz
        • gauge-4.0.0.tgz
          • wide-align-1.1.5.tgz
            • string-width-2.1.1.tgz
              • strip-ansi-4.0.0.tgz
                • ❌ ansi-regex-3.0.0.tgz (Vulnerable Library)

ansi-regex-5.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/npm/node_modules/cli-table3/node_modules/ansi-regex/package.json

Dependency Hierarchy:

• semantic-release-19.0.2.tgz (Root Library)
  • npm-9.0.0.tgz
    • npm-8.4.1.tgz
      • cli-table3-0.6.1.tgz
        • string-width-4.2.2.tgz
          • strip-ansi-6.0.0.tgz
            • ❌ ansi-regex-5.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1e18b6188d5b291d49ce564132948efa43897d04

Found in base branch: master

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution (ansi-regex): 3.0.1

Direct dependency fix Resolution (semantic-release): 19.0.3

Fix Resolution (ansi-regex): 5.0.1

Direct dependency fix Resolution (semantic-release): 19.0.3

---

Step up your Open Source Security Game with Mend here

WS-2022-0238 (High) detected in parse-url-6.0.0.tgz - autoclosed

WS-2022-0238 - High Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1e18b6188d5b291d49ce564132948efa43897d04

Found in base branch: master

Vulnerability Details

File Protocol Spoofing in parse-url before 8.0.0 can lead to attacks, such as XSS, Arbitrary Read/Write File, and Remote Code Execution.

Publish Date: 2022-06-30

URL: WS-2022-0238

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/52060edb-e426-431b-a0d0-e70407e44f18/

Release Date: 2022-06-30

Fix Resolution: parse-url - 8.0.0

---

Step up your Open Source Security Game with Mend here

Feature: Check awesome list for new rules

Is your feature request related to a problem? Please describe.
https://github.com/dustinspecker/awesome-eslint

Bug: add import recommendations [1.7.0]

Issue Description
check import plugin recommendations

• "import/imports-first": 2,
• "import/order": [2, {"groups": ["builtin", "external", "internal", "parent", "sibling", "index" ]}],
• "import/newline-after-import": 2

Bug: False Positives

lines-between-class-members
"exceptAfterSingleLine": true

Please follow the general troubleshooting steps first:

• I've searched on the issue tracker before creating one.
• I'm running the latest package version.
• I'm ready to provide help with a fix if needed.

CVE-2022-0235 (Medium) detected in node-fetch-2.6.1.tgz - autoclosed

CVE-2022-0235 - Medium Severity Vulnerability

Vulnerable Library - node-fetch-2.6.1.tgz

A light-weight module that brings window.fetch to node.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-fetch/package.json

Dependency Hierarchy:

• danger-10.8.0.tgz (Root Library)
  • ❌ node-fetch-2.6.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Publish Date: 2022-01-16

URL: CVE-2022-0235

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r683-j2x4-v87g

Release Date: 2022-01-16

Fix Resolution: node-fetch - 2.6.7,3.1.1

---

Step up your Open Source Security Game with WhiteSource here

CVE-2022-38900 (High) detected in decode-uri-component-0.2.0.tgz - autoclosed

CVE-2022-38900 - High Severity Vulnerability

Vulnerable Library - decode-uri-component-0.2.0.tgz

A better decodeURIComponent

Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/decode-uri-component/package.json

Dependency Hierarchy:

• danger-10.9.0.tgz (Root Library)
  • gitlab-10.2.1.tgz
    • query-string-6.14.1.tgz
      • ❌ decode-uri-component-0.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 1e18b6188d5b291d49ce564132948efa43897d04

Found in base branch: master

Vulnerability Details

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

Publish Date: 2022-11-28

URL: CVE-2022-38900

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with Mend here

CVE-2022-2900 (High) detected in parse-url-6.0.0.tgz - autoclosed

CVE-2022-2900 - High Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1e18b6188d5b291d49ce564132948efa43897d04

Found in base branch: master

Vulnerability Details

Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.

Publish Date: 2022-09-14

URL: CVE-2022-2900

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-09-14

Fix Resolution: parse-url - 8.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2022-2218 (Medium) detected in parse-url-6.0.0.tgz - autoclosed

CVE-2022-2218 - Medium Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1e18b6188d5b291d49ce564132948efa43897d04

Found in base branch: master

Vulnerability Details

Cross-site Scripting (XSS) - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0.

Publish Date: 2022-06-27

URL: CVE-2022-2218

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/024912d3-f103-4daf-a1d0-567f4d9f2bf5/

Release Date: 2022-06-27

Fix Resolution: parse-url - 6.0.1

---

Step up your Open Source Security Game with Mend here

CVE-2022-31051 (High) detected in semantic-release-19.0.2.tgz - autoclosed

CVE-2022-31051 - High Severity Vulnerability

Vulnerable Library - semantic-release-19.0.2.tgz

Automated semver compliant package publishing

Library home page: https://registry.npmjs.org/semantic-release/-/semantic-release-19.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/semantic-release/package.json

Dependency Hierarchy:

• ❌ semantic-release-19.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 1e18b6188d5b291d49ce564132948efa43897d04

Found in base branch: master

Vulnerability Details

semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials. Users are advised to upgrade. Users unable to upgrade should ensure that secrets that do not contain characters that are excluded from encoding with encodeURI when included in a URL are already masked properly.

Publish Date: 2022-06-09

URL: CVE-2022-31051

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-x2pg-mjhr-2m5x

Release Date: 2022-06-09

Fix Resolution: 19.0.3

---

Step up your Open Source Security Game with Mend here

Lalaps Dashboard

This issue provides visibility into Lalaps updates and their statuses.

npm

minimatch ReDoS vulnerability
Library: minimatch
Affected versions: <3.0.5
Severity: high
Root Libraries:

Prototype Pollution in minimist
Library: minimist
Affected versions: <1.2.6
Severity: critical
✔️ #81
✔️ #71
✔️ #72
Root Libraries:

Inefficient Regular Expression Complexity in chalk/ansi-regex
Library: ansi-regex
Affected versions: >=3.0.0 <3.0.1
Severity: high
✔️ #71
✔️ #72
Root Libraries:

decode-uri-component vulnerable to Denial of Service (DoS)
Library: decode-uri-component
Affected versions: <=0.2.0
Severity: low
Root Libraries:

• ❌ danger

Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects
Library: follow-redirects
Affected versions: <1.14.8
Severity: moderate
✔️ #71
✔️ #72
Root Libraries:

Packing does not respect root-level ignore files in workspaces
Library: npm
Affected versions: >=7.9.0 <8.11.0
Severity: high
✔️ #71
✔️ #72
Root Libraries:

Authorization Bypass in parse-path
Library: parse-path
Affected versions: <5.0.0
Severity: high
Root Libraries:

Cross site scripting in parse-url
Library: parse-url
Affected versions: <6.0.1
Severity: moderate
✔️ #71
✔️ #72
Root Libraries:

Exposure of Sensitive Information to an Unauthorized Actor in semantic-release
Library: semantic-release
Affected versions: >=17.0.4 <19.0.3
Severity: moderate
✔️ #71
✔️ #72
Root Libraries:

• ✔️ semantic-release #71 #72

Regular expression denial of service in semver-regex
Library: semver-regex
Affected versions: <3.1.4
Severity: low
✔️ #71
✔️ #72
Root Libraries:

Last Updated: 01 Dec 2022, at 01:14 UTC