Git Product home page Git Product logo

alexrogalskiy / java-patterns Goto Github PK

View Code? Open in Web Editor NEW
11.0 3.0 4.0 29.61 MB

๐Ÿ† Java4You Design patterns

Home Page: https://alexander-rogalsky.gitbook.io/java-patterns/

License: GNU General Public License v3.0

Shell 7.95% JavaScript 26.45% Dockerfile 1.86% Starlark 1.34% Python 0.79% Go 0.27% Open Policy Agent 0.33% Makefile 4.46% CSS 14.30% HTML 36.40% TypeScript 4.68% Batchfile 0.10% Smarty 1.03% Kotlin 0.03% Vim Script 0.01%
java patterns-design ebook patterns java-development

java-patterns's Introduction

Java Design Patterns

Java Design patterns

Nullable labs Java patterns Java patterns Java patterns Gitee Java patterns Codacy Github stars

GitHub tag (latest by date) GitHub Release Date Lines of code GitHub closed issues GitHub closed pull requests GitHub repo size GitHub last commit GitHub GitHub language count GitHub search hit counter GitHub Repository branches GitHub Repository dependents

GitHub version Gitpod ready-to-code first-timers-only Friendly Open Source Helpers The Changelog Discuss Sourcegraph DOI FOSSA Status Renovatebot Dependabot NewReleases Stack Overflow Reddit Hashnode Hits-of-Code Maintainability ComVer GitHub Super-Linter Documentation Status NetflixOSS Lifecycle CI first-timers-only

๐ŸŽน Table of contents

โ˜ Summary

Java Project Status: Active โ€“ The project has reached a stable, usable state and is being actively developed. Project created status Project updated status

Java Design Patterns is intended to provide various use case scenarios and architectural concepts on prototyping adaptive applications.

mkdocs.yml    # Configuration file.
docs/
    readme.md  # General information
    summary.md  # Table of contents
    units/
        design-patterns.md # Design patterns and architectural concepts
        scenarios.md # Scenarios in practice
        use-cases.md # Typical use cases
    user-guide/
        changelog.md # Changelog page
        code_of_conduct.md # Code of conduct page
        code_owners.md # Code owners page
        dependency.md # Dependency page
        description.md # Description page
        faq.md # FAQ page
        getting-started.md # Getting started page
        troubleshooting.md # Troubleshooting page
        upgrade.md # Upgrade page
    reporting/
        info.md # Informational page
        issue_template.md # Issue template page
        bug_report.md # Bug report template
        custom_report.md # Custom report template
        feature_request_template.md # Feature request template
        pull_request_template.md # Pull request template
    contributing/
        info.md # Contributing page
    links/
        info.md # Links page

๐Ÿ“ Documentation

The Website documentation is provided by gitbook and can be discovered at url:

Java Patterns

To enable documentation serving at localhost you can run the following script

./scripts/build-docs.sh

otherwise, the next steps should be considered:

1) Install/upgrade pip command-line utility:

pip install --upgrade pip

or if you need to install pip for the first time:

wget --no-check-certificate https://bootstrap.pypa.io/get-pip.py
python get-pip.py

2) Install the mkdocs package using pip:

pip install mkdocs

or more conveniently for Windows subsystem:

python -m pip install mkdocs --quiet

or via provided software package manager tool:

brew install mkdocs     # macOS
sudo apt install mkdocs # Ubuntu
sudo yum install mkdocs # CentOS/RHEL

3) Install the material theme for the website:

python -m pip install mkdocs-material --quiet
python -m pip install markdown-include --quiet
...
(see requirements.txt)
...

4) Start a web server on your local machine at localhost, where you can see the entire website โ€“ with hot-reload when you save a change by running the following command:

python -m mkdocs build --clean --config-file mkdocs.yml
python -m mkdocs serve --verbose --dirtyreload

The site is served from the address specified in configuration file mkdocs.yml. The MkDocs default is localhost:8000, but the current configuration file sets it:

dev_addr: '0.0.0.0:8000'

The --dirtyreload option limits rebuilds to the changed page, which means changes to mkdocs.yml are not reflected. If you change mkdocs.yml, stop and restart python -m mkdocs serve --verbose --dirtyreload.

5) Deploy to GitHub pages:

python -m mkdocs --verbose gh-deploy --force --remote-branch gh-pages

5) Open up localhost in browser to get the default documentation homepage.

๐Ÿงถ Kubernetes

Running k8s cluster with tilt command by acquiring k8s deployment configuration:

tilt up

Shutting down k8s cluster with provisioned resources removal:

tilt down --delete-namespaces

โฐ Statistics

Documentation PageSpeed result dashboard

๐Ÿ“ Versioning

The project uses SemVer for versioning. For the versions available, see the tags on this repository.

๐ŸŒน Authors

Java Patterns is maintained by the following GitHub team-members:

  • Author

with community support please contact with us if you have some question or proposition.

๐Ÿ’• Contributing

Contributors Display

Please read CONTRIBUTING.md for details on our code of conduct, and the process for submitting pull requests to us (emoji key).

More on information on project contributions can be found at CHANGELOG.md.

This project follows the all-contributors specification. Contributions of any kind are welcome!

GitHub contributors

PRs Welcome Github contributors

See also the list of contributors who participated in this project.

Edit with Gitpod

Java Design Patterns has experimental support for Gitpod, a pre-configured development environment that runs in your browser. To use Gitpod, click the button below and sign in with GitHub. Gitpod also offers a browser add-on, though it is not required.

Open in CodeSandbox

๐Ÿšจ Visitor stats

GitHub page hits

GitHub stars GitHub forks GitHub watchers

โšฝ Licensing

Java Patterns is distributed under LGPL version 3 or later, [License]. LGPLv3 is additional permissions on top of GPLv3.

image

๐ŸŒŸ Development Support

Like Java Design patterns and Java Patterns ? Consider buying me a coffee :)

Become a Patron Buy Me A Coffee KoFi

๐Ÿ‘จโ€๐Ÿ‘จโ€๐Ÿ‘งโ€๐Ÿ‘ฆ Acknowledgement

Stargazers repo roster for @AlexRogalskiy/java-patterns

Stargazers over time

Statistics report

Star History Char

๐Ÿ“Ž OpenGraph Card

OpenGraph card

๐Ÿ”ฅ Feeds and Podcasts

Reddit posts

InfoWorld posts

Let's talk posts

Random thoughts posts

Better code posts

Inside Java posts

Java programmer posts

Dreamix posts

Plumbr posts

Thorben Janssen posts

Redhat posts

JavaCodeGeeks posts

DevCases posts


forthebadge forthebadge forthebadge

java-patterns's People

Contributors

alexrogalskiy avatar dependabot[bot] avatar github-actions[bot] avatar pre-commit-ci[bot] avatar renovate-bot avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar

java-patterns's Issues

CVE-2021-23337 (High) detected in lodash-2.4.2.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 1f54da4e2f129b3291544c4cf7a37509f981ecf3

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in lodash-2.4.2.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 1f54da4e2f129b3291544c4cf7a37509f981ecf3

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2021-33623 (High) detected in trim-newlines-1.0.0.tgz

CVE-2021-33623 - High Severity Vulnerability

Vulnerable Library - trim-newlines-1.0.0.tgz

Trim newlines from the start and/or end of a string

Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-1.0.0.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/get-pkg-repo/node_modules/trim-newlines/package.json,java-patterns/node_modules/alex/node_modules/trim-newlines/package.json

Dependency Hierarchy:

  • textlint-rule-alex-1.3.1.tgz (Root Library)
    • alex-5.1.0.tgz
      • meow-3.7.0.tgz
        • โŒ trim-newlines-1.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1b4aacceb567516b14f2acefdfaac2d063f30df5

Found in base branch: master

Vulnerability Details

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

Publish Date: 2021-05-28

URL: CVE-2021-33623

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623

Release Date: 2021-05-28

Fix Resolution: trim-newlines - 3.0.1, 4.0.1


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-2.4.2.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: f36cb2df7ee03044a62dbafa76b2f227006460dc

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

Your .dependabot/config.yml contained invalid details

Dependabot encountered the following error when parsing your .dependabot/config.yml:

The property '#/' contains additional properties ["updates"] outside of the schema when none are allowed
The property '#/version' value 2 did not match one of the following values: 1
The property '#/update_configs' of type null did not match the following type: array

Please update the config file to conform with Dependabot's specification using our docs and online validator.

CVE-2018-16487 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: f36cb2df7ee03044a62dbafa76b2f227006460dc

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8203 (High) detected in lodash-2.4.2.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: f36cb2df7ee03044a62dbafa76b2f227006460dc

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-10-21

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • remark-preset-davidtheclark-0.12.0.tgz (Root Library)
    • remark-cli-7.0.1.tgz
      • remark-11.0.2.tgz
        • remark-parse-7.0.2.tgz
          • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: c7e18da0aa615be0999facab96109b66dd25deaf

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • textlint-rule-alex-1.3.1.tgz (Root Library)
    • alex-5.1.0.tgz
      • remark-parse-4.0.0.tgz
        • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Repository problems

These problems occurred while renovating this repository. View logs.

  • WARN: Package lookup failures

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

  • โฌ†๏ธ Updates peter-evans/rebase digest to 201049c
  • โฌ†๏ธ Updates @compodoc/compodoc to ^1.1.24
  • โฌ†๏ธ Updates @types/node-fetch to ^2.6.11
  • โฌ†๏ธ Updates @types/puppeteer to ^5.4.7
  • โฌ†๏ธ Updates Actions-R-Us/actions-tagger action to v2.0.3
  • โฌ†๏ธ Updates Matticusau/pr-helper action to v1.3.3
  • โฌ†๏ธ Updates akhilmhdh/contributors-readme-action action to v2.3.8
  • โฌ†๏ธ Updates alex to ^9.1.1
  • โฌ†๏ธ Updates anchore/scan-action action to v1.0.10
  • โฌ†๏ธ Updates bundlesize to ^0.18.2
  • โฌ†๏ธ Updates check-spelling/check-spelling action to v0.0.22
  • โฌ†๏ธ Updates d3 to v3.5.17
  • โฌ†๏ธ Updates d3-scale to ^4.0.2
  • โฌ†๏ธ Updates husky to ^7.0.4
  • โฌ†๏ธ Updates jinja2 to >=2.11.3
  • โฌ†๏ธ Updates jshint to ^2.13.6
  • โฌ†๏ธ Updates license-check-and-add to ^4.0.5
  • โฌ†๏ธ Updates mkdocs-git-committers-plugin to >=0.2.3
  • โฌ†๏ธ Updates nodemon to ^2.0.22
  • โฌ†๏ธ Updates sangonzal/repository-traffic-action action to v0.1.5
  • โฌ†๏ธ Updates source-map-explorer to ^2.5.3
  • โฌ†๏ธ Updates syncpack to ^6.2.1
  • โฌ†๏ธ Updates textlint-rule-en-capitalization to ^2.0.3
  • โฌ†๏ธ Updates textlint-rule-terminology to ^2.1.6
  • โฌ†๏ธ Updates ts-jest to ^27.1.5
  • โฌ†๏ธ Updates underscore to ^1.13.6 (underscore, @types/underscore)
  • โฌ†๏ธ Updates yogevbd/enforce-label-action action to v2.2.2
  • โฌ†๏ธ Updates @changesets/changelog-github to ^0.5.0
  • โฌ†๏ธ Updates @changesets/cli to ^2.27.1
  • โฌ†๏ธ Updates @changesets/write to ^0.3.0
  • โฌ†๏ธ Updates @microsoft/api-extractor to ^7.43.1
  • โฌ†๏ธ Updates @size-limit/preset-small-lib to ^8.2.6
  • โฌ†๏ธ Updates @testing-library/jest-dom to ^5.17.0
  • โฌ†๏ธ Updates @types/jest to ^27.5.2
  • โฌ†๏ธ Updates JamesIves/github-sponsors-readme-action action to v1.4.0
  • โฌ†๏ธ Updates LouisBrunner/checks-action action to v1.6.2
  • โฌ†๏ธ Updates Node.js
  • โฌ†๏ธ Updates Node.js to v14.21.3
  • โฌ†๏ธ Updates actions/checkout action to v2.7.0
  • โฌ†๏ธ Updates actions/checkout action to v3.6.0
  • โฌ†๏ธ Updates actions/setup-node action to v2.5.2
  • โฌ†๏ธ Updates all-contributors-cli to ^6.26.1
  • โฌ†๏ธ Updates apache/skywalking-eyes action to v0.6.0
  • โฌ†๏ธ Updates browser-sync to ^2.30.0-alpha.3
  • โฌ†๏ธ Updates c3 to v0.7.20
  • โฌ†๏ธ Updates chromatic to ^6.25.0-canary.0
  • โฌ†๏ธ Updates cirrus-actions/rebase action to v1.8
  • โฌ†๏ธ Updates commitlint monorepo (@commitlint/cli, @commitlint/config-conventional)
  • โฌ†๏ธ Updates conventional-changelog-cli to ^2.2.2
  • โฌ†๏ธ Updates d3-array to ^3.2.4
  • โฌ†๏ธ Updates d3-time to ^3.1.0
  • โฌ†๏ธ Updates d3-time-format to ^4.1.0
  • โฌ†๏ธ Updates dessant/lock-threads action to v2.1.2
  • โฌ†๏ธ Updates devmasx/merge-branch action to v1.4.0
  • โฌ†๏ธ Updates fountainhead/action-wait-for-check action to v1.2.0
  • โฌ†๏ธ Updates git-cz to ^4.9.0
  • โฌ†๏ธ Updates helm/chart-releaser-action action to v1.6.0
  • โฌ†๏ธ Updates helm/chart-testing-action action to v2.6.1
  • โฌ†๏ธ Updates helm/kind-action action to v1.10.0
  • โฌ†๏ธ Updates highlight.js to v10.7.3
  • โฌ†๏ธ Updates hmarr/auto-approve-action action to v2.4.0
  • โฌ†๏ธ Updates ibiqlik/action-yamllint action to v3.1.1
  • โฌ†๏ธ Updates import-conductor to ^2.6.1
  • โฌ†๏ธ Updates jest-expect-message to ^1.1.3 (jest-expect-message, @types/jest-expect-message)
  • โฌ†๏ธ Updates jest-image-snapshot to ^5.2.0
  • โฌ†๏ธ Updates jest-junit to ^13.2.0
  • โฌ†๏ธ Updates jest-puppeteer to ^6.2.0
  • โฌ†๏ธ Updates jest-watch-typeahead to ^1.1.0
  • โฌ†๏ธ Updates linkinator to ^3.1.0
  • โฌ†๏ธ Updates lint-staged to ^11.3.0-beta.2
  • โฌ†๏ธ Updates lintspaces-cli to ^0.8.0
  • โฌ†๏ธ Updates lockfile-lint to ^4.13.2
  • โฌ†๏ธ Updates loglevel to ^1.9.1
  • โฌ†๏ธ Updates lycheeverse/lychee-action action to v1.9.3
  • โฌ†๏ธ Updates markdown to >=3.6
  • โฌ†๏ธ Updates markdown-checklist to >=0.4.4
  • โฌ†๏ธ Updates markdown-include to >=0.8.1
  • โฌ†๏ธ Updates markdown-link-check to ^3.12.1
  • โฌ†๏ธ Updates markdownlint-cli to ^0.39.0
  • โฌ†๏ธ Updates mdx-truly-sane-lists to >=1.3
  • โฌ†๏ธ Updates mkautodoc to >=0.2.0
  • โฌ†๏ธ Updates mkdocs to >=1.6.0
  • โฌ†๏ธ Updates mkdocs-awesome-pages-plugin to >=2.9.2
  • โฌ†๏ธ Updates mkdocs-codeinclude-plugin to >=0.2.1
  • โฌ†๏ธ Updates mkdocs-git-revision-date-localized-plugin to >=0.12.1
  • โฌ†๏ธ Updates mkdocs-include-markdown-plugin to >=3.9.1
  • โฌ†๏ธ Updates mkdocs-literate-nav to >=0.6.1
  • โฌ†๏ธ Updates mkdocs-macros-plugin to >=0.7.0
  • โฌ†๏ธ Updates mkdocs-markdownextradata-plugin to >=0.2.5
  • โฌ†๏ธ Updates mkdocs-material to >=7.3.6
  • โฌ†๏ธ Updates mkdocs-material-extensions to >=1.3.1
  • โฌ†๏ธ Updates mkdocs-mermaid2-plugin to >=0.6.0
  • โฌ†๏ธ Updates mkdocs-minify-plugin to >=0.8.0
  • โฌ†๏ธ Updates mkdocs-redirects to >=1.2.1
  • โฌ†๏ธ Updates mkdocs-static-i18n to >=0.56
  • โฌ†๏ธ Updates mkdocs-video to >=1.5.0
  • โฌ†๏ธ Updates mszostok/codeowners-validator action to v0.7.4
  • โฌ†๏ธ Updates node to v17.9.1 (node, @types/node)
  • โฌ†๏ธ Updates node-fetch to ^3.3.2
  • โฌ†๏ธ Updates npm to >= 5.10.0
  • โฌ†๏ธ Updates npm-check-updates to ^16.14.18
  • โฌ†๏ธ Updates npm-package-arg to ^9.1.2
  • โฌ†๏ธ Updates pascalgn/automerge-action action to v0.16.3
  • โฌ†๏ธ Updates patch-package to ^6.5.1
  • โฌ†๏ธ Updates pozil/auto-assign-issue action to v1.14.0
  • โฌ†๏ธ Updates prettier to ^2.8.8
  • โฌ†๏ธ Updates pretty-quick to ^3.3.1
  • โฌ†๏ธ Updates puppeteer to ^13.7.0
  • โฌ†๏ธ Updates puppeteer to ^15.5.0
  • โฌ†๏ธ Updates pygments to >=2.17.2
  • โฌ†๏ธ Updates python Docker tag to v3.13.0a6
  • โฌ†๏ธ Updates python-markdown-math to >=0.8
  • โฌ†๏ธ Updates release-it to ^14.14.3
  • โฌ†๏ธ Updates repo-link-check to ^0.14.2
  • โฌ†๏ธ Updates size-limit to ^8.2.6
  • โฌ†๏ธ Updates snyk to ^1.1290.0
  • โฌ†๏ธ Updates sort-package-json to ^1.57.0
  • โฌ†๏ธ Updates stefanprodan/helm-gh-pages action to v1.7.0
  • โฌ†๏ธ Updates stylelint to ^14.16.1
  • โฌ†๏ธ Updates stylelint-scss to ^3.21.0
  • โฌ†๏ธ Updates textlint to ^12.6.1
  • โฌ†๏ธ Updates tiangolo/issue-manager action to v0.5.0
  • โฌ†๏ธ Updates tretuna/sync-branches action to v1.4.0
  • โฌ†๏ธ Updates ts-node to ^10.9.2
  • โฌ†๏ธ Updates typescript to ^4.9.5
  • โฌ†๏ธ Updates typescript-coverage-report to ^0.8.0
  • โฌ†๏ธ Updates yaml-lint to ^1.7.0
  • โฌ†๏ธ Updates @octokit/rest to v20
  • โฌ†๏ธ Updates @size-limit/preset-small-lib to v11
  • โฌ†๏ธ Updates @testing-library/jest-dom to v6
  • โฌ†๏ธ Updates @types/puppeteer to v7
  • โฌ†๏ธ Updates EndBug/add-and-commit action to v9
  • โฌ†๏ธ Updates LouisBrunner/checks-action action to v2
  • โฌ†๏ธ Updates MCJack123/ghaction-generate-release-hashes action to v4
  • โฌ†๏ธ Updates Node.js to v20 (node, @types/node)
  • โฌ†๏ธ Updates Node.js to v21
  • โฌ†๏ธ Updates actions/cache action to v4
  • โฌ†๏ธ Updates actions/checkout action to v4
  • โฌ†๏ธ Updates actions/github-script action to v7
  • โฌ†๏ธ Updates actions/setup-go action to v5
  • โฌ†๏ธ Updates actions/setup-java action to v4
  • โฌ†๏ธ Updates actions/setup-node action to v4
  • โฌ†๏ธ Updates actions/setup-python action to v5
  • โฌ†๏ธ Updates actions/stale action to v9
  • โฌ†๏ธ Updates actions/upload-artifact action to v4
  • โฌ†๏ธ Updates alex to v11
  • โฌ†๏ธ Updates anchore/scan-action action to v3
  • โฌ†๏ธ Updates aws-actions/stale-issue-cleanup action to v6
  • โฌ†๏ธ Updates azure/setup-helm action to v4
  • โฌ†๏ธ Updates browser-sync to v3
  • โฌ†๏ธ Updates chromatic to v11
  • โฌ†๏ธ Updates commitlint monorepo to v19 (major) (@commitlint/cli, @commitlint/config-conventional)
  • โฌ†๏ธ Updates conventional-changelog-cli to v4
  • โฌ†๏ธ Updates cookiecutter to v2
  • โฌ†๏ธ Updates crazy-max/ghaction-github-labeler action to v5
  • โฌ†๏ธ Updates d3 to v7
  • โฌ†๏ธ Updates dangoslen/changelog-enforcer action to v3
  • โฌ†๏ธ Updates del-cli to v5
  • โฌ†๏ธ Updates dessant/lock-threads action to v5
  • โฌ†๏ธ Updates docker/build-push-action action to v5
  • โฌ†๏ธ Updates docker/login-action action to v3
  • โฌ†๏ธ Updates docker/setup-buildx-action action to v3
  • โฌ†๏ธ Updates docker/setup-qemu-action action to v3
  • โฌ†๏ธ Updates execa to v8
  • โฌ†๏ธ Updates github/codeql-action action to v3
  • โฌ†๏ธ Updates github/super-linter action to v6
  • โฌ†๏ธ Updates highlight.js to v11
  • โฌ†๏ธ Updates hmarr/auto-approve-action action to v4
  • โฌ†๏ธ Updates husky to v9
  • โฌ†๏ธ Updates jest monorepo to v29 (major) (@jest/test-sequencer, @types/jest, jest, jest-circus, ts-jest)
  • โฌ†๏ธ Updates jest-extended to v4
  • โฌ†๏ธ Updates jest-image-snapshot to v6
  • โฌ†๏ธ Updates jest-junit to v16
  • โฌ†๏ธ Updates jest-puppeteer to v10
  • โฌ†๏ธ Updates jest-watch-typeahead to v2
  • โฌ†๏ธ Updates jinja2 to v3
  • โฌ†๏ธ Updates jsdom to v24
  • โฌ†๏ธ Updates lannonbr/issue-label-manager-action action to v4
  • โฌ†๏ธ Updates lerna to v8
  • โฌ†๏ธ Updates linkinator to v6
  • โฌ†๏ธ Updates lint-staged to v15
  • โฌ†๏ธ Updates mcr.microsoft.com/vscode/devcontainers/javascript-node Docker tag to v1
  • โฌ†๏ธ Updates mike to v2
  • โฌ†๏ธ Updates mkdocs-git-revision-date-localized-plugin to v1
  • โฌ†๏ธ Updates mkdocs-include-markdown-plugin to v6
  • โฌ†๏ธ Updates mkdocs-macros-plugin to v1
  • โฌ†๏ธ Updates mkdocs-material to v9
  • โฌ†๏ธ Updates mkdocs-mermaid2-plugin to v1
  • โฌ†๏ธ Updates mkdocs-static-i18n to v1
  • โฌ†๏ธ Updates mondeja/remove-labels-gh-action action to v2
  • โฌ†๏ธ Updates node to v22
  • โฌ†๏ธ Updates nodemon to v3
  • โฌ†๏ธ Updates npm to v10
  • โฌ†๏ธ Updates npm-package-arg to v11
  • โฌ†๏ธ Updates patch-package to v8
  • โฌ†๏ธ Updates peaceiris/actions-gh-pages action to v4
  • โฌ†๏ธ Updates peter-evans/create-or-update-comment action to v4
  • โฌ†๏ธ Updates peter-evans/create-pull-request action to v6
  • โฌ†๏ธ Updates pnpm/action-setup action to v3
  • โฌ†๏ธ Updates prettier to v3
  • โฌ†๏ธ Updates pretty-quick to v4
  • โฌ†๏ธ Updates prologic/action-remark-lint action to v5
  • โฌ†๏ธ Updates puppeteer to v22
  • โฌ†๏ธ Updates pymdown-extensions to v10
  • โฌ†๏ธ Updates release-it to v17
  • โฌ†๏ธ Updates remark (major) (remark-cli, remark-lint-code-block-style, remark-lint-ordered-list-marker-value, remark-validate-links)
  • โฌ†๏ธ Updates size-limit to v11
  • โฌ†๏ธ Updates sort-package-json to v2
  • โฌ†๏ธ Updates stefanzweifel/git-auto-commit-action action to v5
  • โฌ†๏ธ Updates stylelint to v16
  • โฌ†๏ธ Updates stylelint-config-standard to v36
  • โฌ†๏ธ Updates stylelint-order to v6
  • โฌ†๏ธ Updates stylelint-scss to v6
  • โฌ†๏ธ Updates svgo to v3
  • โฌ†๏ธ Updates syncpack to v12
  • โฌ†๏ธ Updates tempy to v3
  • โฌ†๏ธ Updates textlint to v14
  • โฌ†๏ธ Updates textlint-rule-alex to v5
  • โฌ†๏ธ Updates textlint-rule-stop-words to v4
  • โฌ†๏ธ Updates textlint-rule-terminology to v4
  • โฌ†๏ธ Updates tibdex/backport action to v2
  • โฌ†๏ธ Updates typescript to v5
  • โฌ†๏ธ Updates typescript-coverage-report to v1
  • โฌ†๏ธ Updates ubuntu to v22
  • โฌ†๏ธ Updates w3c-xmlserializer to v5
  • โฌ†๏ธ Updates wagoid/commitlint-github-action action to v6
  • โฌ†๏ธ Lock file maintenance
  • ๐Ÿ” Create all rate-limited PRs at once ๐Ÿ”

Edited/Blocked

These updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox.


Warning

Renovate failed to look up the following dependencies: Failed to look up github-tags package iterative/link-check.action, Failed to look up pypi package java-patterns.

Files affected: .github/workflows/link-check-all.yml, .github/workflows/link-check-deploy.yml, setup.py


Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

Detected dependencies

docker-compose
docker-compose.yml
dockerfile
.devcontainer/Dockerfile
  • mcr.microsoft.com/vscode/devcontainers/javascript-node 0-16-bullseye
.github/actions/release-notes/Dockerfile
.gitpod.Dockerfile
.space/webstorm/Dockerfile
  • node 14-bullseye
distribution/docker-images/ci.Dockerfile
  • node 12-buster
distribution/docker-images/dev.Dockerfile
  • node 12-buster
distribution/docker-images/release.Dockerfile
  • node 12-buster
tilt_modules/restart_process/Dockerfile
github-actions
.github/workflows/action-devto.yml
  • actions/checkout v2
  • ful1e5/TheActionDev v2
.github/workflows/add-labels.yml
.github/workflows/auto-approve.yml
  • hmarr/auto-approve-action v2.1.0
.github/workflows/auto-assign-issues.yml
  • pozil/auto-assign-issue v1.4.0
.github/workflows/auto-tag.yml
  • actions/checkout v2
.github/workflows/automerge-dependabot.yml
  • fountainhead/action-wait-for-check v1.0.0
  • fountainhead/action-wait-for-check v1.0.0
  • actions/github-script v6
.github/workflows/automerge.yml
  • pascalgn/automerge-action v0.15.2
.github/workflows/backport.yml
  • tibdex/backport v1
  • ubuntu 18.04
.github/workflows/blogpost-workflow.yml
  • actions/checkout v2
.github/workflows/broken-links.yml
  • actions/checkout v2
  • actions/setup-node v2.1.4
.github/workflows/build.yml
  • actions/checkout v2
  • actions/checkout v2
  • actions/setup-node v1
  • pnpm/action-setup v1.2.1
.github/workflows/changelog.yml
  • actions/cache v2.1.4
.github/workflows/chart-release.yaml
  • actions/checkout v2
  • azure/setup-helm v1
  • helm/chart-releaser-action v1.1.0
.github/workflows/check-changelog.yml
  • actions/github-script 0.9.0
.github/workflows/check-urls.yml
  • actions/checkout v2
  • trilom/file-changes-action v1.2.4
  • actions/upload-artifact v2
.github/workflows/checklist.yml
  • actions/checkout v1
.github/workflows/cla.yml
  • cla-assistant/github-action v2.1.3-beta
.github/workflows/claim.yml
  • actions/github-script v3.1
.github/workflows/clean.yml
  • actions/github-script v6
.github/workflows/cleanup.yml
  • kolpav/purge-artifacts-action v1
.github/workflows/close-pending.yml
.github/workflows/closed-issue-message.yml
  • aws-actions/closed-issue-message v1
.github/workflows/closing.yml
  • peter-evans/create-or-update-comment v1
  • peter-evans/create-or-update-comment v1
  • ubuntu 18.04
.github/workflows/codeball.yml
.github/workflows/codeql-analysis.yml
  • actions/checkout v2
  • github/codeql-action v1
  • github/codeql-action v1
.github/workflows/codesee-arch-diagram.yml
  • actions/checkout v2
  • actions/setup-java v3
  • actions/setup-node v3
  • actions/setup-python v2
  • actions-rs/toolchain v1
.github/workflows/codespell.yaml
  • actions/checkout v2
.github/workflows/color-check.yml
  • actions/checkout v2
.github/workflows/comment_on_issue.yml
  • actions/github-script v3.1
.github/workflows/comments.yml
.github/workflows/commitlint.yml
  • actions/checkout v2
  • wagoid/commitlint-github-action v2.2.5
.github/workflows/compress.yml
  • actions/checkout v2
  • peter-evans/create-pull-request v3
.github/workflows/cve-scan.yml
  • actions/checkout v2
.github/workflows/dead-link-checker.yaml
  • actions/checkout v2
.github/workflows/delete-workflow-runs.yml
  • Mattraks/delete-workflow-runs v2
.github/workflows/docker.yaml
  • actions/checkout v2
  • anchore/scan-action 1.0.6
  • actions/upload-artifact v2
.github/workflows/download-link-check-deploy.yml
  • actions/checkout v2
  • lycheeverse/lychee-action v1.0.8
.github/workflows/enforce-changelog.yml
  • actions/checkout v2
  • dangoslen/changelog-enforcer v2
.github/workflows/enforce-labels.yml
  • yogevbd/enforce-label-action 2.2.1
.github/workflows/fossa.yml
  • actions/checkout v2
  • actions/setup-go v2
.github/workflows/generate-chart-readme.yml
  • actions/checkout v2
  • actions/cache v2
  • actions/checkout v2
  • trilom/file-changes-action v1.2.4
.github/workflows/gh-pages.yml
  • JamesIves/github-pages-deploy-action 4.1.4
.github/workflows/github.yml
  • actions/checkout v2
  • micnncim/action-label-syncer v1
.github/workflows/gitleaks.yml
  • actions/checkout v3
  • gitleaks/gitleaks-action v2
.github/workflows/greetings.yml
.github/workflows/hash-gen.yml
  • MCJack123/ghaction-generate-release-hashes v1
  • svenstaro/upload-release-action v2
.github/workflows/helm.yml
  • actions/checkout v2
  • docker/setup-qemu-action v1
  • docker/setup-buildx-action v1
  • docker/login-action v1
  • docker/build-push-action v2
  • stefanprodan/helm-gh-pages v1.3.0
.github/workflows/insert-contributors.yml
  • bubkoo/contributors-list v1
  • actions/checkout v2
  • JamesIves/github-sponsors-readme-action 1.0.5
  • akhilmhdh/contributors-readme-action v2.3.4
.github/workflows/issue-manager.yml
  • tiangolo/issue-manager 0.3.0
.github/workflows/issue-triage.yml
  • actions/github-script v3
.github/workflows/k8s.yml
  • actions/checkout v2
  • azure/setup-helm v1
.github/workflows/label.yml
.github/workflows/labels.yml
  • lannonbr/issue-label-manager-action 2.0.0
.github/workflows/labels2.yml
  • actions/checkout v2
  • crazy-max/ghaction-github-labeler v3
.github/workflows/license-eyes.yml
  • actions/checkout v2
  • apache/skywalking-eyes v0.2.0
.github/workflows/link-check-all.yml
  • actions/checkout v2
  • iterative/link-check.action v0.7
.github/workflows/link-check-deploy.yml
  • actions/checkout v2
  • LouisBrunner/checks-action v1.0.0
  • iterative/link-check.action v0.7
  • LouisBrunner/checks-action v1.0.0
  • LouisBrunner/checks-action v1.0.0
.github/workflows/lint-md.yml
  • actions/checkout v3
.github/workflows/lint-pr.yml
.github/workflows/lint-test.yaml
  • actions/checkout v2
  • azure/setup-helm v1
  • actions/setup-python v2
  • helm/chart-testing-action v2.0.1
  • helm/kind-action v1.1.0
  • actions/checkout v2
  • helm/chart-testing-action v2.1.0
  • helm/kind-action v1.2.0
  • actions/checkout v2
.github/workflows/lint.yml
  • actions/checkout v2
  • actions/setup-python v1
  • ubuntu 20.04
.github/workflows/linter.yml
  • actions/checkout v3
  • github/super-linter v4
.github/workflows/lock.yml
  • dessant/lock-threads v2.0.3
.github/workflows/lychee-cron.yaml
  • actions/checkout v2
  • actions/setup-node v1
  • lycheeverse/lychee-action v1.0.8
.github/workflows/lychee-pr.yaml
  • actions/checkout v2
  • actions/setup-node v1
  • lycheeverse/lychee-action v1.0.8
.github/workflows/merge_master_to_dev.yml
  • actions/checkout v2
  • devmasx/merge-branch v1.3.1
.github/workflows/mkdocs.yml
  • actions/checkout v2
  • actions/setup-python v2
  • actions/cache v2
  • peaceiris/actions-gh-pages v3
  • ubuntu 18.04
.github/workflows/no-response.yml
  • lee-dohm/no-response v0.5.0
  • ubuntu 20.04
.github/workflows/opengraph-card.yml
  • actions/checkout v2
  • stefanzweifel/git-auto-commit-action v4
.github/workflows/pagespeed.yml
  • actions/checkout v2
  • stefanzweifel/git-auto-commit-action v4
.github/workflows/performance-comparison-label.yml
  • actions-ecosystem/action-remove-labels v1
  • actions/checkout v3
  • peter-evans/create-or-update-comment c9fcb64660bc90ec1cc535646af190c992007c32
.github/workflows/pr-helper.yml
  • Matticusau/pr-helper v1.3.0
.github/workflows/pr.yml
  • actions/checkout v1
  • actions/checkout v1
.github/workflows/project-card-moved.yml
  • technote-space/auto-card-labeler v1
.github/workflows/rebase.yml
  • actions/checkout v2
  • cirrus-actions/rebase 1.4
.github/workflows/rebase_dispatch.yml
  • peter-evans/rebase 08cedbbd4eabcd913bf091844614eceddaea4a5d
  • peter-evans/create-or-update-comment c9fcb64660bc90ec1cc535646af190c992007c32
  • peter-evans/create-or-update-comment c9fcb64660bc90ec1cc535646af190c992007c32
.github/workflows/release-changelog.yml
.github/workflows/release.yml
  • actions/checkout v2
  • haya14busa/action-bumpr v1
  • haya14busa/action-update-semver v1
  • haya14busa/action-cond v1
  • actions/create-release v1
  • actions/checkout v2
  • haya14busa/action-bumpr v1
.github/workflows/remove-labels.yml
  • mondeja/remove-labels-gh-action v1
  • mondeja/remove-labels-gh-action v1
  • mondeja/remove-labels-gh-action v1
.github/workflows/remove-old-artifacts.yml
  • c-hive/gha-remove-artifacts v1
.github/workflows/remove-stale.yml
.github/workflows/renovate.yml
  • bodinsamuel/renovate-automatic-branch v1
.github/workflows/repo-traffic.yml
  • actions/checkout v2
  • sangonzal/repository-traffic-action v0.1.4
  • EndBug/add-and-commit v4
.github/workflows/reviewdog.yml
  • actions/checkout v2
  • prologic/action-remark-lint v2
.github/workflows/semgrep.yml
  • actions/checkout v2
  • returntocorp/semgrep-action v1
.github/workflows/shiftleft-analysis.yml
  • actions/checkout v1
  • github/codeql-action v1
.github/workflows/size-limit.yml
  • actions/checkout v2
  • andresz1/size-limit-action v1
.github/workflows/spellcheck.yml
.github/workflows/spelling.yml
  • actions/checkout v2
  • check-spelling/check-spelling v0.0.19
.github/workflows/stale.yml
  • actions/stale v3
.github/workflows/stale_issue.yml
  • aws-actions/stale-issue-cleanup v3
.github/workflows/support-window.yml
  • actions/checkout v3
  • actions/setup-node v3
.github/workflows/sync.yml
  • actions/checkout v2
  • actions/setup-node v2.1.4
  • tretuna/sync-branches 1.2.0
.github/workflows/toc.yml
  • actions/checkout v2
  • stefanzweifel/git-auto-commit-action v4
.github/workflows/unlock-reopened-issues.yml
  • Dunning-Kruger/unlock-issues v1.1
.github/workflows/update-checksum.yml
  • actions/setup-python v2
  • actions/checkout v2
.github/workflows/validate-codeowners.yml
  • actions/checkout v3
  • mszostok/codeowners-validator v0.5.0
  • mszostok/codeowners-validator v0.5.0
.github/workflows/version-update.yml
  • actions/checkout v2
  • stefanzweifel/git-auto-commit-action v4
.github/workflows/versioning.yml
  • actions/checkout v3.0.1
  • Actions-R-Us/actions-tagger v2.0.2
.github/workflows/welcome_contributor.yml
  • actions/github-script v3.1
.github/workflows/yaml-lint.yml
  • actions/checkout v2.3.4
  • ibiqlik/action-yamllint v3.0.2
helm-values
charts/values.yaml
helmfile
helmfile.yaml
html
datas.html
  • c3 0.4.10
  • d3 3.5.15
  • c3 0.4.10
docs/overrides/addons/base.html
  • highlight.js 10.5.0
  • highlight.js 10.5.0
  • highlight.js 10.5.0
npm
package.json
  • @bitjson/npm-scripts-info ^1.0.0
  • @cadolabs/crowdin-cli ^3.0.19
  • @changesets/changelog-github ^0.4.8
  • @changesets/cli ^2.26.0
  • @changesets/write ^0.2.3
  • @commitlint/cli ^16.2.3
  • @commitlint/config-conventional ^16.2.1
  • @types/node ^17.0.21
  • adr-tools ^2.0.4
  • alex ^9.1.0
  • all-contributors-cli ^6.20.0
  • browser-sync ^2.27.7
  • changelog-machine ^1.0.2
  • chart-csv ^1.0.3
  • check-for-leaks ^1.2.1
  • chromatic ^6.14.0
  • colors ^1.4.0
  • conventional-changelog-cli ^2.1.1
  • cost-of-modules 1.0.1
  • csvnorm ^1.1.0
  • danger-plugin-spellcheck ^2.1.0
  • deploy-to-gh-pages ^1.3.7
  • dockerfile_lint ^0.3.4
  • execa ^5.1.1
  • git-cz ^4.7.6
  • gitbook-cli ^2.3.2
  • github-contributors-list ^1.2.5
  • husky ^7.0.1
  • import-conductor ^2.4.0
  • is-ci ^3.0.1
  • jscs ^3.0.7
  • jshint ^2.13.4
  • jsonlint ^1.6.3
  • lerna ^4.0.0
  • lerna-changelog ^2.2.0
  • lerna-update-wizard ^1.1.2
  • license-checker ^25.0.1
  • linkinator ^3.0.3
  • lint-staged ^11.0.1
  • lintspaces-cli ^0.7.1
  • markdown-link-check ^3.8.7
  • markdownlint-cli ^0.27.1
  • node-fetch ^3.2.3
  • nodemon ^2.0.15
  • npm-check-updates ^16.6.0
  • npm-package-arg ^9.0.1
  • opencollective-postinstall ^2.0.3
  • patch-package ^6.4.7
  • prettier ^2.3.2
  • pretty-quick ^3.1.1
  • release-it ^14.10.0
  • remark-cli ^9.0.0
  • remark-lint-code-block-style ^2.0.1
  • remark-lint-ordered-list-marker-value ^2.0.1
  • remark-preset-davidtheclark ^0.12.0
  • remark-validate-links ^10.0.4
  • repo-link-check ^0.7.1
  • roadmarks ^1.6.3
  • shelljs ^0.8.5
  • snyk ^1.946.0
  • solidarity ^3.0.4
  • sort-package-json ^1.54.0
  • stylelint ^14.8.5
  • stylelint-config-standard ^22.0.0
  • stylelint-order ^4.1.0
  • stylelint-scss ^3.20.1
  • svgo ^2.8.0
  • syncpack ^6.2.0
  • tempy ^2.0.0
  • textlint ^12.0.2
  • textlint-rule-alex ^3.0.0
  • textlint-rule-common-misspellings ^1.0.1
  • textlint-rule-en-capitalization ^2.0.2
  • textlint-rule-stop-words ^2.0.9
  • textlint-rule-terminology ^2.1.5
  • textlint-rule-write-good ^2.0.0
  • ts-node ^10.7.0
  • typescript ^4.6.2
  • validate-commit-msg ^2.14.0
  • webtreemap-cli ^2.3.2
  • yalc ^1.0.0-pre.53
  • yaml-lint ^1.2.4
  • node >= 12.x
  • npm >= 5.0.0
packages/changelog/package.json
  • @compodoc/compodoc ^1.1.19
  • @jest/test-sequencer ^27.5.1
  • @size-limit/preset-small-lib ^8.1.0
  • @testing-library/jest-dom ^5.16.4
  • @microsoft/api-extractor ^7.21.0
  • @types/jest ^27.4.1
  • @types/jest-expect-message ^1.0.4
  • @types/node ^17.0.21
  • auto-changelog ^2.4.0
  • await-sleep ^0.0.1
  • bundlesize ^0.18.1
  • codeclimate-test-reporter ^0.5.1
  • coveralls ^3.1.1
  • cross-env 7.0.3
  • del-cli ^4.0.1
  • env-cmd ^10.1.0
  • identity-obj-proxy ^3.0.0
  • jest ^27.5.1
  • jest-circus ^27.5.1
  • jest-environment-node-debug ^2.0.0
  • jest-expect-message ^1.0.2
  • jest-extended ^2.0.0
  • jest-extended-snapshot ^1.1.5
  • jest-fetch-mock ^3.0.3
  • jest-html ^1.5.0
  • jest-junit ^13.0.0
  • jest-image-snapshot ^5.1.0
  • jest-puppeteer ^6.1.1
  • jest-sonar-reporter ^2.0.0
  • jest-supertest-matchers ^0.0.2
  • jest-watch-select-projects ^2.0.0
  • jest-watch-typeahead ^1.0.0
  • license-check-and-add ^4.0.3
  • lockfile-lint ^4.7.4
  • loglevel ^1.8.0
  • mockdate ^3.0.5
  • nodejs-dashboard ^0.5.1
  • nodelinter ^0.1.19
  • puppeteer ^15.3.1
  • size-limit ^8.1.0
  • solidarity ^3.0.4
  • source-map-explorer ^2.5.2
  • ts-jest ^27.1.4
  • ts-node ^10.7.0
  • tsdx ^0.14.1
  • typescript ^4.6.2
  • typescript-coverage-report ^0.6.4
  • node >= 12.x
  • npm >= 5.0.0
packages/contributors-view/package.json
  • @compodoc/compodoc ^1.1.19
  • @jest/test-sequencer ^27.5.1
  • @testing-library/jest-dom ^5.16.4
  • @microsoft/api-extractor ^7.21.0
  • @types/jest ^27.4.1
  • @types/jest-expect-message ^1.0.4
  • @types/node ^17.0.21
  • @types/puppeteer ^5.4.5
  • auto-changelog ^2.4.0
  • await-sleep ^0.0.1
  • bundlesize ^0.18.1
  • codeclimate-test-reporter ^0.5.1
  • coveralls ^3.1.1
  • cross-env 7.0.3
  • del-cli ^4.0.1
  • env-cmd ^10.1.0
  • identity-obj-proxy ^3.0.0
  • jest ^27.5.1
  • jest-circus ^27.5.1
  • jest-environment-node-debug ^2.0.0
  • jest-expect-message ^1.0.2
  • jest-extended ^2.0.0
  • jest-extended-snapshot ^1.1.5
  • jest-fetch-mock ^3.0.3
  • jest-html ^1.5.0
  • jest-junit ^13.0.0
  • jest-sonar-reporter ^2.0.0
  • jest-supertest-matchers ^0.0.2
  • jest-watch-select-projects ^2.0.0
  • jest-watch-typeahead ^1.0.0
  • license-check-and-add ^4.0.3
  • lockfile-lint ^4.7.4
  • loglevel ^1.8.0
  • mockdate ^3.0.5
  • nodejs-dashboard ^0.5.1
  • nodelinter ^0.1.19
  • puppeteer ^13.5.1
  • solidarity ^3.0.4
  • source-map-explorer ^2.5.2
  • ts-jest ^27.1.4
  • ts-node ^10.7.0
  • tsdx ^0.14.1
  • typescript ^4.6.2
  • typescript-coverage-report ^0.6.4
  • node >= 12.x
  • npm >= 5.0.0
packages/github-client/package.json
  • @compodoc/compodoc ^1.1.19
  • @jest/test-sequencer ^27.5.1
  • @testing-library/jest-dom ^5.16.4
  • @microsoft/api-extractor ^7.21.0
  • @octokit/rest ^18.12.0
  • @types/jest ^27.4.1
  • @types/jest-expect-message ^1.0.4
  • @types/node ^17.0.21
  • @types/node-fetch ^2.6.1
  • @types/puppeteer ^5.4.5
  • @types/underscore ^1.11.4
  • auto-changelog ^2.4.0
  • await-sleep ^0.0.1
  • bundlesize ^0.18.1
  • codeclimate-test-reporter ^0.5.1
  • coveralls ^3.1.1
  • cross-env 7.0.3
  • del-cli ^4.0.1
  • env-cmd ^10.1.0
  • identity-obj-proxy ^3.0.0
  • jest ^27.5.1
  • jest-circus ^27.5.1
  • jest-environment-node-debug ^2.0.0
  • jest-expect-message ^1.0.2
  • jest-extended ^2.0.0
  • jest-extended-snapshot ^1.1.5
  • jest-fetch-mock ^3.0.3
  • jest-html ^1.5.0
  • jest-junit ^13.0.0
  • jest-sonar-reporter ^2.0.0
  • jest-supertest-matchers ^0.0.2
  • jest-watch-select-projects ^2.0.0
  • jest-watch-typeahead ^1.0.0
  • license-check-and-add ^4.0.3
  • lockfile-lint ^4.7.4
  • loglevel ^1.8.0
  • mockdate ^3.0.5
  • node-fetch ^3.2.3
  • nodelinter ^0.1.19
  • solidarity ^3.0.4
  • source-map-explorer ^2.5.2
  • ts-jest ^27.1.4
  • ts-node ^10.7.0
  • tsdx ^0.14.1
  • typescript ^4.6.2
  • typescript-coverage-report ^0.6.4
  • underscore ^1.13.2
  • node >= 12.x
  • npm >= 5.0.0
packages/graph-view/package.json
  • @compodoc/compodoc ^1.1.19
  • @jest/test-sequencer ^27.5.1
  • @testing-library/jest-dom ^5.16.4
  • @microsoft/api-extractor ^7.21.0
  • @types/jest ^27.4.1
  • @types/jest-expect-message ^1.0.4
  • @types/node ^17.0.21
  • auto-changelog ^2.4.0
  • await-sleep ^0.0.1
  • bundlesize ^0.18.1
  • codeclimate-test-reporter ^0.5.1
  • coveralls ^3.1.1
  • cross-env 7.0.3
  • d3-array ^3.0.2
  • d3-axis ^3.0.0
  • d3-scale ^4.0.0
  • d3-selection ^3.0.0
  • d3-time ^3.0.0
  • d3-time-format ^4.0.0
  • del-cli ^4.0.1
  • env-cmd ^10.1.0
  • identity-obj-proxy ^3.0.0
  • jest ^27.5.1
  • jest-circus ^27.5.1
  • jest-environment-node-debug ^2.0.0
  • jest-expect-message ^1.0.2
  • jest-extended ^2.0.0
  • jest-extended-snapshot ^1.1.5
  • jest-fetch-mock ^3.0.3
  • jest-html ^1.5.0
  • jest-junit ^13.0.0
  • jest-sonar-reporter ^2.0.0
  • jest-supertest-matchers ^0.0.2
  • jest-watch-select-projects ^2.0.0
  • jest-watch-typeahead ^1.0.0
  • jsdom ^17.0.0
  • license-check-and-add ^4.0.3
  • lockfile-lint ^4.7.4
  • loglevel ^1.8.0
  • mockdate ^3.0.5
  • nodejs-dashboard ^0.5.1
  • nodelinter ^0.1.19
  • solidarity ^3.0.4
  • source-map-explorer ^2.5.2
  • ts-jest ^27.1.4
  • ts-node ^10.7.0
  • tsdx ^0.14.1
  • typescript ^4.6.2
  • typescript-coverage-report ^0.6.4
  • w3c-xmlserializer ^2.0.0
  • node >= 12.x
  • npm >= 5.0.0
packages/schema-diff/package.json
  • @compodoc/compodoc ^1.1.19
  • @jest/test-sequencer ^27.5.1
  • @testing-library/jest-dom ^5.16.4
  • @microsoft/api-extractor ^7.21.0
  • @types/jest ^27.4.1
  • @types/jest-expect-message ^1.0.4
  • @types/node ^17.0.21
  • @types/puppeteer ^5.4.5
  • auto-changelog ^2.4.0
  • await-sleep ^0.0.1
  • bundlesize ^0.18.1
  • codeclimate-test-reporter ^0.5.1
  • coveralls ^3.1.1
  • cross-env 7.0.3
  • del-cli ^4.0.1
  • env-cmd ^10.1.0
  • identity-obj-proxy ^3.0.0
  • jest ^27.5.1
  • jest-circus ^27.5.1
  • jest-environment-node-debug ^2.0.0
  • jest-expect-message ^1.0.2
  • jest-extended ^2.0.0
  • jest-extended-snapshot ^1.1.5
  • jest-fetch-mock ^3.0.3
  • jest-html ^1.5.0
  • jest-junit ^13.0.0
  • jest-sonar-reporter ^2.0.0
  • jest-supertest-matchers ^0.0.2
  • jest-watch-select-projects ^2.0.0
  • jest-watch-typeahead ^1.0.0
  • license-check-and-add ^4.0.3
  • lockfile-lint ^4.7.4
  • loglevel ^1.8.0
  • mockdate ^3.0.5
  • nodelinter ^0.1.19
  • solidarity ^3.0.4
  • source-map-explorer ^2.5.2
  • ts-jest ^27.1.4
  • ts-node ^10.7.0
  • tsdx ^0.14.1
  • typescript ^4.6.2
  • typescript-coverage-report ^0.6.4
  • node >= 12.x
  • npm >= 5.0.0
tilt_modules/tilt_inspector/package.json
  • @tilt.dev/tilt-inspector 0.1.8
nvm
.nvmrc
  • node 17.1.0
packages/changelog/.nvmrc
  • node 17.1.0
packages/contributors-view/.nvmrc
  • node 17.1.0
packages/github-client/.nvmrc
  • node 17.1.0
packages/graph-view/.nvmrc
  • node 17.1.0
packages/schema-diff/.nvmrc
  • node 17.1.0
pip_requirements
docs/requirements.txt
  • jinja2 >=2.11.1
  • click-man >=0.4.1
  • mkdocs >=1.2
  • pygments >=2.4
  • mkdocs-material >=7.1.2
  • mkdocs-video >=1.3.0
  • markdown >=3.2
  • markdown-checklist >=0.0.1
  • fontawesome-markdown >=0.2.6
  • mkdocs-em-img2fig-plugin >=0.3.2
  • markdown-include >=0.6.0
  • pymdown-extensions >=8.2
  • python-markdown-math >=0.6
  • mkdocs-literate-nav >=0.4.1
  • mkdocs-material-extensions >=1.0
  • mkdocs-git-revision-date-localized-plugin >=0.9.2
  • mkdocs-awesome-pages-plugin >=2.5.0
  • mkdocs-mermaid2-plugin >=0.5.2
  • mkdocs-plugin-tags >=1.0.2
  • mkdocs-macros-plugin >=0.6.3
  • mkdocs-static-i18n >=0.14
  • mkdocs-minify-plugin >=0.5.0
  • mdx-truly-sane-lists >=1.2
  • mkdocs-include-markdown-plugin >=3.2.1
  • mkdocs-codeinclude-plugin >=0.1.0
  • mkdocs-markdownextradata-plugin >=0.1.1
  • mkdocs-redirects >=1.0.3
  • smarty >=0.3.3
  • cookiecutter >=1.7.3
  • mkdocs-git-committers-plugin >=0.2.2
  • mike >=1.1.2
  • mkautodoc >=0.1.0
  • mkdocs-simple-hooks >=0.1.5
pip_setup
setup.py
  • java-patterns =================
pyenv
.python-version
  • python 3.8.2

  • Check this box to trigger a request for Renovate to run again on this repository

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: 1f54da4e2f129b3291544c4cf7a37509f981ecf3

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2020-15366 (Medium) detected in ajv-4.11.8.tgz

CVE-2020-15366 - Medium Severity Vulnerability

Vulnerable Library - ajv-4.11.8.tgz

Another JSON Schema Validator

Library home page: https://registry.npmjs.org/ajv/-/ajv-4.11.8.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/@textlint/linter-formatter/node_modules/ajv/package.json

Dependency Hierarchy:

  • textlint-11.9.1.tgz (Root Library)
    • linter-formatter-3.3.5.tgz
      • table-3.8.3.tgz
        • โŒ ajv-4.11.8.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

Publish Date: 2020-07-15

URL: CVE-2020-15366

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/ajv-validator/ajv/releases/tag/v6.12.3

Release Date: 2020-07-15

Fix Resolution: ajv - 6.12.3


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8203 (High) detected in lodash-2.4.2.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 1038786febc4d2287b75f9010bdf82c268a44175

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-10-21

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: cab1959b859528c75870a68a563948e475d590f7

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8203 (High) detected in lodash-2.4.2.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-10-21

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in lodash-2.4.2.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 1b4aacceb567516b14f2acefdfaac2d063f30df5

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 1f54da4e2f129b3291544c4cf7a37509f981ecf3

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: 1038786febc4d2287b75f9010bdf82c268a44175

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in lodash-2.4.2.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 1b4aacceb567516b14f2acefdfaac2d063f30df5

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • remark-preset-davidtheclark-0.12.0.tgz (Root Library)
    • remark-cli-7.0.1.tgz
      • remark-11.0.2.tgz
        • remark-parse-7.0.2.tgz
          • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 1f54da4e2f129b3291544c4cf7a37509f981ecf3

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2018-3721 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 1f54da4e2f129b3291544c4cf7a37509f981ecf3

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in lodash-2.4.2.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: f36cb2df7ee03044a62dbafa76b2f227006460dc

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2021-33623 (High) detected in trim-newlines-1.0.0.tgz

CVE-2021-33623 - High Severity Vulnerability

Vulnerable Library - trim-newlines-1.0.0.tgz

Trim newlines from the start and/or end of a string

Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-1.0.0.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/get-pkg-repo/node_modules/trim-newlines/package.json,java-patterns/node_modules/alex/node_modules/trim-newlines/package.json

Dependency Hierarchy:

  • textlint-rule-alex-1.3.1.tgz (Root Library)
    • alex-5.1.0.tgz
      • meow-3.7.0.tgz
        • โŒ trim-newlines-1.0.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

Publish Date: 2021-05-28

URL: CVE-2021-33623

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623

Release Date: 2021-05-28

Fix Resolution: trim-newlines - 3.0.1, 4.0.1


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • alex-9.1.0.tgz (Root Library)
    • remark-parse-8.0.3.tgz
      • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 1038786febc4d2287b75f9010bdf82c268a44175

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1010266 (Medium) detected in lodash-2.4.2.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 1b4aacceb567516b14f2acefdfaac2d063f30df5

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1010266 (Medium) detected in lodash-2.4.2.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: f36cb2df7ee03044a62dbafa76b2f227006460dc

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • alex-9.1.0.tgz (Root Library)
    • remark-parse-8.0.3.tgz
      • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: f36cb2df7ee03044a62dbafa76b2f227006460dc

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: f36cb2df7ee03044a62dbafa76b2f227006460dc

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-2.4.2.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 1038786febc4d2287b75f9010bdf82c268a44175

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-2.4.2.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1010266 (Medium) detected in lodash-2.4.2.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1010266 (Medium) detected in lodash-2.4.2.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 1038786febc4d2287b75f9010bdf82c268a44175

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8203 (High) detected in lodash-2.4.2.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 1f54da4e2f129b3291544c4cf7a37509f981ecf3

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-10-21

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-2.4.2.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 1b4aacceb567516b14f2acefdfaac2d063f30df5

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

CVE-2018-3721 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: f36cb2df7ee03044a62dbafa76b2f227006460dc

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5


Step up your Open Source Security Game with WhiteSource here

CVE-2021-33623 (High) detected in trim-newlines-1.0.0.tgz

CVE-2021-33623 - High Severity Vulnerability

Vulnerable Library - trim-newlines-1.0.0.tgz

Trim newlines from the start and/or end of a string

Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-1.0.0.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/get-pkg-repo/node_modules/trim-newlines/package.json

Dependency Hierarchy:

  • conventional-changelog-cli-2.1.1.tgz (Root Library)
    • conventional-changelog-3.1.24.tgz
      • conventional-changelog-core-4.2.2.tgz
        • get-pkg-repo-1.4.0.tgz
          • meow-3.7.0.tgz
            • โŒ trim-newlines-1.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1f54da4e2f129b3291544c4cf7a37509f981ecf3

Found in base branch: master

Vulnerability Details

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

Publish Date: 2021-05-28

URL: CVE-2021-33623

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623

Release Date: 2021-05-28

Fix Resolution: trim-newlines - 3.0.1, 4.0.1


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8203 (High) detected in lodash-2.4.2.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 1b4aacceb567516b14f2acefdfaac2d063f30df5

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-10-21

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: c7e18da0aa615be0999facab96109b66dd25deaf

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in lodash-2.4.2.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 1038786febc4d2287b75f9010bdf82c268a44175

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2018-3721 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • textlint-rule-alex-1.3.1.tgz (Root Library)
    • alex-5.1.0.tgz
      • remark-parse-4.0.0.tgz
        • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 1b4aacceb567516b14f2acefdfaac2d063f30df5

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2020-15366 (Medium) detected in ajv-4.11.8.tgz

CVE-2020-15366 - Medium Severity Vulnerability

Vulnerable Library - ajv-4.11.8.tgz

Another JSON Schema Validator

Library home page: https://registry.npmjs.org/ajv/-/ajv-4.11.8.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/@textlint/linter-formatter/node_modules/ajv/package.json

Dependency Hierarchy:

  • textlint-11.9.1.tgz (Root Library)
    • linter-formatter-3.3.5.tgz
      • table-3.8.3.tgz
        • โŒ ajv-4.11.8.tgz (Vulnerable Library)

Found in HEAD commit: 1b4aacceb567516b14f2acefdfaac2d063f30df5

Found in base branch: master

Vulnerability Details

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

Publish Date: 2020-07-15

URL: CVE-2020-15366

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/ajv-validator/ajv/releases/tag/v6.12.3

Release Date: 2020-07-15

Fix Resolution: ajv - 6.12.3


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • remark-preset-davidtheclark-0.12.0.tgz (Root Library)
    • remark-cli-7.0.1.tgz
      • remark-11.0.2.tgz
        • remark-parse-7.0.2.tgz
          • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: cab1959b859528c75870a68a563948e475d590f7

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2018-3721 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 1b4aacceb567516b14f2acefdfaac2d063f30df5

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1010266 (Medium) detected in lodash-2.4.2.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 1f54da4e2f129b3291544c4cf7a37509f981ecf3

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: java-patterns/package.json

Path to vulnerable library: java-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: 1b4aacceb567516b14f2acefdfaac2d063f30df5

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.