paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 36 Packages Projects Releases Wiki Activity

Merge pull request #7157 from backstage/rugvip/snyk

Browse Source 
Fix or ignore some security vulnerabilities
This commit is contained in:
Patrik Oldsberg
2021-09-13 13:40:23 +02:00
committed by GitHub
parent ae1fb3b4b2 a76040bc5c
commit ade09f3bac
3 changed files with 94 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/cli/.snyk
+60
View File
@@ -7,4 +7,64 @@ ignore:
reason: Developer tools are not a valid target for ReDoS attacks
expires: 2022-03-06T17:18:55.019Z
created: 2021-09-06T17:18:55.027Z
SNYK-JS-ANSIREGEX-1583908:
- '*':
reason: Developer tools are not a valid target for ReDoS attacks
expires: 2022-03-06T17:18:55.019Z
created: 2021-09-06T17:18:55.027Z
SNYK-JS-CSSWHAT-1298035:
- '*':
reason: Developer tools are not a valid target for ReDoS attacks
expires: 2022-03-06T17:18:55.019Z
created: 2021-09-06T17:18:55.027Z
SNYK-JS-BROWSERSLIST-1090194:
- '*':
reason: Developer tools are not a valid target for ReDoS attacks
expires: 2022-03-06T17:18:55.019Z
created: 2021-09-06T17:18:55.027Z
SNYK-JS-ISSVG-1243891:
- '*':
reason: Developer tools are not a valid target for ReDoS attacks
expires: 2022-03-06T17:18:55.019Z
created: 2021-09-06T17:18:55.027Z
SNYK-JS-ISSVG-1085627:
- '*':
reason: Developer tools are not a valid target for ReDoS attacks
expires: 2022-03-06T17:18:55.019Z
created: 2021-09-06T17:18:55.027Z
SNYK-JS-POSTCSS-1255640:
- '*':
reason: Developer tools are not a valid target for ReDoS attacks
expires: 2022-03-06T17:18:55.019Z
created: 2021-09-06T17:18:55.027Z
SNYK-JS-POSTCSS-1090595:
- '*':
reason: Developer tools are not a valid target for ReDoS attacks
expires: 2022-03-06T17:18:55.019Z
created: 2021-09-06T17:18:55.027Z
SNYK-JS-WS-1296835:
- '*':
reason: Developer tools are not a valid target for ReDoS attacks
expires: 2022-03-06T17:18:55.019Z
created: 2021-09-06T17:18:55.027Z
SNYK-JS-IMMER-1540542:
- '*':
reason: Prototype pollution is not an effective attack against a CLI as it already executes arbitrary code
expires: 2022-03-06T17:18:55.019Z
created: 2021-09-06T17:18:55.027Z
SNYK-JS-SETVALUE-1540541:
- '*':
reason: Prototype pollution is not an effective attack against a CLI as it already executes arbitrary code
expires: 2022-03-06T17:18:55.019Z
created: 2021-09-06T17:18:55.027Z
patch: {}
packages/test-utils/.snyk
+17
View File
@@ -0,0 +1,17 @@
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
version: v1.22.1
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
ignore:
SNYK-JS-ANSIREGEX-1583908:
- '*':
reason: Self-inflicted ReDos in tests is not an issue
expires: 2022-03-06T17:18:55.019Z
created: 2021-09-06T17:18:55.027Z
SNYK-JS-XMLDOM-1534562:
- 'msw@0.29.0 > @mswjs/interceptors@0.10.0 > xmldom@0.6.0':
reason: Self-inflicted XML injection attacks in tests is not an issue
expires: 2022-03-06T17:18:55.019Z
created: 2021-09-06T17:18:55.027Z
patch: {}
yarn.lock
+17 -17
View File
@@ -8297,10 +8297,10 @@ ansi-regex@^5.0.0:
resolved "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz#388539f55179bf39339c81af30a654d69f87cb75"
integrity sha512-bY6fj56OUQ0hU1KjFNDQuJFezqKdrAyFdIevADiqrWHwSlbmBNMHp5ak2f40Pm8JTFyM2mqxkG6ngkHO11f/lg==
ansi-regex@^6.0.0:
version "6.0.0"
resolved "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.0.0.tgz#ecc7f5933cbe5ac7b33e209a5ff409ab1669c6b2"
integrity sha512-tAaOSrWCHF+1Ear1Z4wnJCXA9GGox4K6Ic85a5qalES2aeEwQGr7UC93mwef49536PkCYjzkp0zIxfFvexJ6zQ==
ansi-regex@^6.0.1:
version "6.0.1"
resolved "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.0.1.tgz#3183e38fae9a65d7cb5e53945cd5897d0260a06a"
integrity sha512-n5M855fKb2SsfMIiFFoVrABHJC8QtHwVx+mHWP3QcEqBHYienj5dHSgjbxtC0WEZXYt4wcD6zrQElDPhFuZgfA==
ansi-styles@^2.2.1:
version "2.2.1"
@@ -25090,11 +25090,11 @@ strip-ansi@^4.0.0:
ansi-regex "^3.0.0"
strip-ansi@^7.0.0:
version "7.0.0"
resolved "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.0.0.tgz#1dc49b980c3a4100366617adac59327eefdefcb0"
integrity sha512-UhDTSnGF1dc0DRbUqr1aXwNoY3RgVkSWG8BrpnuFIxhP57IqbS7IRta2Gfiavds4yCxc5+fEAVVOgBZWnYkvzg==
version "7.0.1"
resolved "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.0.1.tgz#61740a08ce36b61e50e65653f07060d000975fb2"
integrity sha512-cXNxvT8dFNRVfhVME3JAe98mkXDYN2O1l7jmcwMnOslDeESg1rF/OZMtK0nRAhiari1unG5cD4jG3rapUAkLbw==
dependencies:
ansi-regex "^6.0.0"
ansi-regex "^6.0.1"
strip-bom@^2.0.0:
version "2.0.0"
@@ -25750,9 +25750,9 @@ thenify-all@^1.0.0:
thenify ">= 3.1.0 < 4"
"thenify@>= 3.1.0 < 4":
version "3.3.0"
resolved "https://registry.npmjs.org/thenify/-/thenify-3.3.0.tgz#e69e38a1babe969b0108207978b9f62b88604839"
integrity sha1-5p44obq+lpsBCCB5eLn2K4hgSDk=
version "3.3.1"
resolved "https://registry.npmjs.org/thenify/-/thenify-3.3.1.tgz#8932e686a4066038a016dd9e2ca46add9838a95f"
integrity sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==
dependencies:
any-promise "^1.0.0"
@@ -27739,14 +27739,14 @@ y18n@^3.2.1:
integrity sha512-uGZHXkHnhF0XeeAPgnKfPv1bgKAYyVvmNL1xlKsPYZPaIHxGti2hHqvOCQv71XMsLxu1QjergkqogUnms5D3YQ==
y18n@^4.0.0:
version "4.0.0"
resolved "https://registry.npmjs.org/y18n/-/y18n-4.0.0.tgz#95ef94f85ecc81d007c264e190a120f0a3c8566b"
integrity sha512-r9S/ZyXu/Xu9q1tYlpsLIsa3EeLXXk0VwlxqTcFRfg9EhMW+17kbt9G0NrgCmhGb5vT2hyhJZLfDGx+7+5Uj/w==
version "4.0.3"
resolved "https://registry.npmjs.org/y18n/-/y18n-4.0.3.tgz#b5f259c82cd6e336921efd7bfd8bf560de9eeedf"
integrity sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==
y18n@^5.0.5:
version "5.0.5"
resolved "https://registry.npmjs.org/y18n/-/y18n-5.0.5.tgz#8769ec08d03b1ea2df2500acef561743bbb9ab18"
integrity sha512-hsRUr4FFrvhhRH12wOdfs38Gy7k2FFzB9qgN9v3aLykRq0dRcdcpz5C9FxdS2NuhOrI/628b/KSTJ3rwHysYSg==
version "5.0.8"
resolved "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz#7f4934d0f7ca8c56f95314939ddcd2dd91ce1d55"
integrity sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==
yallist@^2.1.2:
version "2.1.2"