| Summary: | node audit identified several vulnerable node dependencies | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Paul Derscheid <paul.derscheid> |
| Component: | Architecture, internals, and plumbing | Assignee: | Bugs List <koha-bugs> |
| Status: | Signed Off --- | QA Contact: | Testopia <testopia> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | david, dcook |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Attachments: |
Dependency report from Jenkins
Bug 41587: Fix critical and high severity node dependency vulnerabilities Bug 41587: Fix moderate severity node dependency vulnerabilities Bug 41587: Fix moderate severity node dependency vulnerabilities Bug 41587: Fix critical and high severity node dependency vulnerabilities Bug 41587: Fix moderate severity node dependency vulnerabilities |
||
Created attachment 191212 [details] [review] Bug 41587: Fix critical and high severity node dependency vulnerabilities - Upgrade gulp-exec to ^5.0.0 (fixes lodash.template HIGH) - Add resolution for form-data ^2.5.4 (CRITICAL) - Add resolution for braces ^3.0.3 (HIGH) - Add resolution for qs ^6.14.1 (HIGH) Test plan: - yarn audit --level high should show 0 vulnerabilities - yarn build && yarn build:prod should complete without errors - yarn cypress run should return without (or currently expected) errors @RM: You will need to push yarn.lock as well Created attachment 191213 [details] [review] Bug 41587: Fix moderate severity node dependency vulnerabilities - Add resolution for micromatch ^4.0.8 - Add resolution for @cypress/request ^3.0.0 - Add resolution for js-yaml ^4.1.1 Test plan: - yarn audit --level moderate should show reduced vulnerability count - yarn build && yarn build:prod should complete without errors - yarn cypress run should complete without (or currently expected) errors @RM: You will need to push yarn.lock as well Remaining moderate vulnerabilities require larger upgrades and should maybe be handled in dedicated bugs:
- postcss (requires gulp-autoprefixer/gulp-rtlcss upgrade)
- webpack-dev-server (requires Cypress 15+ upgrade path)
I also had 3 failing cypress tests:
Spec Tests Passing Failing Pending Skipped
┌────────────────────────────────────────────────────────────────────────────────────────────────┐
│ ✔ AdditionalFields_spec.ts 00:42 12 12 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ Breadcrumbs_spec.ts 00:06 3 3 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ InfiniteScrollSelect_spec.ts 00:06 4 2 - 2 - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ PatronSearchDebounce_spec.ts 00:02 1 1 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ Toolbar_spec.ts 00:04 2 2 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ VueFramework_spec.ts 00:26 13 13 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ flatpickr_spec.ts 00:02 1 1 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ Acquisitions/Vendors_spec.ts 00:23 6 6 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ Auth/csrf.ts 00:19 6 6 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ Admin/RecordSources_spec.ts 00:07 5 5 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ ERM/Agreements_spec.ts 00:37 5 5 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ ERM/DataProviders_spec.ts 00:33 13 13 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ ERM/Dialog_spec.ts 00:16 5 5 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ ERM/Licenses_spec.ts 00:23 5 5 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ ERM/Main.ts 00:03 2 2 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ ERM/Packages_spec.ts 00:24 5 5 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ ERM/Searchbar_spec.ts 00:04 4 4 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ ERM/Titles_spec.ts 00:29 6 6 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ ERM/UsageReports_spec.ts 00:37 13 13 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ ERM/UserRoles_spec.ts 00:04 1 1 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ KohaTable/CirculationHistory_spec.t 00:02 1 1 - - - │
│ s │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ KohaTable/Holdings_spec.ts 00:36 4 4 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ KohaTable/KohaTable_spec.ts 00:21 11 11 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ KohaTable/OPACCirculationHistory_sp 00:27 1 1 - - - │
│ ec.ts │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ KohaTable/PatronSearch_spec.ts 00:14 6 6 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✖ KohaTable/PendingHolds_spec.ts 00:02 2 - 1 - 1 │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ Islands/AcquisitionsMenu_spec.ts 00:07 4 4 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ Preservation/Main.ts 00:05 3 3 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ Preservation/Settings.ts 00:16 5 5 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ Preservation/Trains.ts 00:27 8 8 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ Preservation/WaitingList.ts 00:08 3 3 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ Patron/Address.ts 00:02 1 1 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ Patron/Format.ts 00:18 9 9 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ SIP2/Accounts.ts 00:16 5 5 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ SIP2/Institutions.ts 00:14 5 5 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ SIP2/SystemPreferenceOverrides.ts 00:11 4 4 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ Tools/ManageMarcImport_spec.ts 00:14 3 3 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✖ t/api-client.ts 0ms - - 1 - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ t/commands.ts 00:04 4 4 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ t/db.ts 102ms 1 1 - - - │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✖ t/insertData.ts 00:03 8 4 1 - 3 │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ✔ t/mockData.ts 511ms 8 8 - - - │
└────────────────────────────────────────────────────────────────────────────────────────────────┘
✖ 3 of 42 failed (7%) 10:12 208 200 3 2 4
But from Jenkins results it seems that these are preexisting ones not caused by the updates.
Created attachment 191215 [details] [review] Bug 41587: Fix moderate severity node dependency vulnerabilities - Add resolution for micromatch ^4.0.8 - Add resolution for @cypress/request ^3.0.0 - Add resolution for js-yaml ^4.1.1 Test plan: - yarn audit --level moderate should show reduced vulnerability count - yarn build && yarn build:prod should complete without errors - yarn cypress run should complete without (or currently expected) errors @RM: You will need to push yarn.lock as well Created attachment 191227 [details] [review] Bug 41587: Fix critical and high severity node dependency vulnerabilities - Upgrade gulp-exec to ^5.0.0 (fixes lodash.template HIGH) - Add resolution for form-data ^2.5.4 (CRITICAL) - Add resolution for braces ^3.0.3 (HIGH) - Add resolution for qs ^6.14.1 (HIGH) Test plan: - yarn audit --level high should show 0 vulnerabilities - yarn build && yarn build:prod should complete without errors - yarn cypress run should return without (or currently expected) errors @RM: You will need to push yarn.lock as well Signed-off-by: David Nind <david@davidnind.com> Created attachment 191228 [details] [review] Bug 41587: Fix moderate severity node dependency vulnerabilities - Add resolution for micromatch ^4.0.8 - Add resolution for @cypress/request ^3.0.0 - Add resolution for js-yaml ^4.1.1 Test plan: - yarn audit --level moderate should show reduced vulnerability count - yarn build && yarn build:prod should complete without errors - yarn cypress run should complete without (or currently expected) errors @RM: You will need to push yarn.lock as well Signed-off-by: David Nind <david@davidnind.com> Testing notes (using KTD): Before ====== yarn audit --level high ~~~~~~~~~~~~~~~~~~~~~~~ ... 31 vulnerabilities found - Packages audited: 1770 Severity: 15 Moderate | 15 High | 1 Critical Done in 1.84s. yarn cypress run ~~~~~~~~~~~~~~~~ Failed tests: ✖ KohaTable/PendingHolds_spec.ts ✖ Tools/ManageMarcImport_spec.ts ✖ t/api-client.ts ✖ t/insertData.ts After ===== yarn audit --level high ~~~~~~~~~~~~~~~~~~~~~~~ yarn audit v1.22.22 10 vulnerabilities found - Packages audited: 1654 Severity: 2 Low | 8 Moderate Done in 3.62s yarn cypress run ~~~~~~~~~~~~~~~~ Failed tests: ✖ KohaTable/PendingHolds_spec.ts ✖ t/api-client.ts ✖ t/insertData.ts ✖ 3 of 42 failed (7%) |
Created attachment 191211 [details] Dependency report from Jenkins Koha_Main_node_audit run #121 identified several vulnerable node dependencies. Not sure yet whether it makes more sense to attach the generated artifact or copy paste it into the summary, attached it this time. Let me know what you think.