Problem/Motivation

Run "npm audit ----omit=dev" on command line and the result is as below:

nvm version 22.22

# npm audit report

immutable 4.0.0-rc.1 - 4.3.7
Severity: high
Immutable is vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-wf6x-7x77-mvgw
fix available via `npm audit fix`
node_modules/immutable

nanoid <3.3.8
Severity: moderate
Predictable results in nanoid generation when given non-integer values - https://github.com/advisories/GHSA-mwcw-c2x4-8c55
fix available via `npm audit fix`
node_modules/nanoid

picomatch <=2.3.1
Severity: high
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
fix available via `npm audit fix`
node_modules/picomatch

postcss <8.5.10
Severity: moderate
PostCSS has XSS via Unescaped

in its CSS Stringify Output - https://github.com/advisories/GHSA-qx2v-qp2m-jg93
fix available via `npm audit fix`
node_modules/postcss

4 vulnerabilities (2 moderate, 2 high)

Proposed resolution

Run `npm audit fix` to fix all vulnerabilities

Issue fork gin-3589411

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

queenielow created an issue. See original summary.

queenielow’s picture

Issue summary: View changes

jurgenhaas made their first commit to this issue’s fork.

jurgenhaas’s picture

Version: 5.0.12 » 5.0.x-dev
Category: Bug report » Task
Priority: Major » Normal
Status: Patch (to be ported) » Needs work
Issue tags: -npm

This isn't a bug and it's not major either. Those packages only get used in dev environments and never in production.

But still, it's worth updating them. However, that requires a few more steps:

  • Not only the lock file should be updated but also the constraints should be bumped
  • The updated versions are producing a different output, that's why the pipeline job for the frontend failed. If that's what happens, then the MR also needs to contain the updated frontend assets.

Please, only set the issue to NR if pipelines are green.