Github detected a vulnerability in fstream < 1.0.12: """ Known moderate severity security vulnerability detected in fstream < 1.0.12 defined in yarn.lock. yarn.lock update suggested: fstream ~> 1.0.12. """ https://snyk.io/vuln/npm:fstream@1.0.11
Created attachment 90272 [details] [review] Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock This patch updates the version requirements for modules used by yarn. The new version of yarn.lock was created by running the command "yarn upgrade"
Without the patch: % yarn build # will generate changes, like: [-no-repeat;height:125px;padding:0;width:80%}.patronimage-controls{left:50%;opacity:0;position:absolute;text-align:center;top:80%;transform:translate(-50%,-50%);transition:.5s-]{+no-repeat;height:125px;padding:0;width:80%}.patronimage-controls{left:50%;opacity:0;position:absolute;text-align:center;top:80%;-webkit-transform:translate(-50%,-50%);transform:translate(-50%,-50%);transition:.5s+} transform vs -webkit-transform
I receieved another email from github on this: This automated pull request fixes a security vulnerability (High severity). Learn more about automated security fixes. Bumps tar from 2.2.1 to 2.2.2. Commits Dependabot compatibility score Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase. Dependabot commands and options You can view, comment on, or merge this pull request online at: https://github.com/Koha-Community/Koha/pull/27 Commit Summary Bump tar from 2.2.1 to 2.2.2 File Changes M yarn.lock (46) Patch Links: https://github.com/Koha-Community/Koha/pull/27.patch https://github.com/Koha-Community/Koha/pull/27.diff
Owen, could we get your blessing for this change?
There is another related to yarn now: Known high severity security vulnerability detected in macaddress < 0.2.9 defined in yarn.lock. yarn.lock update suggested: macaddress ~> 0.2.9.
Created attachment 90598 [details] [review] Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock This patch updates the version requirements for modules used by yarn. The new version of yarn.lock was created by running the command "yarn upgrade" Upgrading yarn.lock should allow for the installation of newer versions of npm modules in new installations. I believe it is necessary to run "yarn upgrade" on existing installations in order to bring dependencies up to versions matching those on existing installations. To test, run the yarn commands we use to compile SCSS in the staff client and the opac: yarn build yarn build --view opac They should complete without error.
postcss-filter-plugins no longer depends on uniqid which depends on macaddress, so the dependency of macaddress is removed. (comment #5) The other two are updated to the versions (comment #1, comment #3) mentioned.
before the patch yarn install yarn build yarn build --view opac There are differences, which I believe are like comment #2, but it's too scrolly to tell. after the patch git bz apply 23025 yarn upgrade yarn build yarn build --view opac only the lock file is different.
Created attachment 90947 [details] [review] Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock This patch updates the version requirements for modules used by yarn. The new version of yarn.lock was created by running the command "yarn upgrade" Upgrading yarn.lock should allow for the installation of newer versions of npm modules in new installations. I believe it is necessary to run "yarn upgrade" on existing installations in order to bring dependencies up to versions matching those on existing installations. To test, run the yarn commands we use to compile SCSS in the staff client and the opac: yarn build yarn build --view opac They should complete without error. Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Created attachment 90948 [details] [review] Bug 23025: (follow-up) yarn.lock updated itself Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Created attachment 90984 [details] [review] Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock This patch updates the version requirements for modules used by yarn. The new version of yarn.lock was created by running the command "yarn upgrade" Upgrading yarn.lock should allow for the installation of newer versions of npm modules in new installations. I believe it is necessary to run "yarn upgrade" on existing installations in order to bring dependencies up to versions matching those on existing installations. To test, run the yarn commands we use to compile SCSS in the staff client and the opac: yarn build yarn build --view opac They should complete without error. Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> https://bugs.koha-community.org/show_bug.cgi?id=20325
(In reply to M. Tompsett from comment #10) > Created attachment 90948 [details] [review] [review] > Bug 23025: (follow-up) yarn.lock updated itself > > Signed-off-by: Mark Tompsett <mtompset@hotmail.com> I didn't SO this one, if I run 'yarn upgrade' I get a whole new set of modules than this patch. I think we only need Owen's initial upgrade - to test I just ran 'yarn install' and it worked as expected I didn't obsolete, left for the RM
I think we should leave the followup for a distinct bug.. yes we should update all our dependencies regularly, but I don't believe doing it inline in this security bug is the best idea.
Created attachment 95612 [details] [review] Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock This patch updates the version requirements for modules used by yarn. Running "yarn upgrade" will upgrade the project's direct dependencies as listed in package.json. However, the output of "yarn audit" will identify more vulnerabilities with libraries further down the dependency tree. Adding a "resolutions" list in package.json seems to be the way to include these upgrades in an installation. After making these changes I ran "yarn install" and "yarn audit" again. The audit reported no vulnerabilities. Upgrading yarn.lock should allow for the installation of newer versions of npm modules in new installations. I believe it is necessary to run "yarn upgrade" on existing installations in order to bring dependencies up to versions matching those on existing installations. To test, run the yarn commands we use to compile SCSS in the staff client and the opac: yarn build yarn build --view opac They should complete without error.
Created attachment 95713 [details] [review] Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock This patch updates the version requirements for modules used by yarn. Running "yarn upgrade" will upgrade the project's direct dependencies as listed in package.json. However, the output of "yarn audit" will identify more vulnerabilities with libraries further down the dependency tree. Adding a "resolutions" list in package.json seems to be the way to include these upgrades in an installation. After making these changes I ran "yarn install" and "yarn audit" again. The audit reported no vulnerabilities. Upgrading yarn.lock should allow for the installation of newer versions of npm modules in new installations. I believe it is necessary to run "yarn upgrade" on existing installations in order to bring dependencies up to versions matching those on existing installations. To test, run the yarn commands we use to compile SCSS in the staff client and the opac: yarn build yarn build --view opac They should complete without error. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signing off and Passing QA in one hit.. I've thoroughly tested this and can confirm our existing build tool all continue to work after applying the patch and running the requisite updates to pull the new dependancies. As these are all just dev side build tools at this point anyway I believe we are safe.
Created attachment 95714 [details] [review] Bug 23025: Update yarn.lock
Nice work! Pushed to master for 19.11.00