Git Product home page Git Product logo

node-express-postgresql's Introduction

Node, Express and PostgreSQL

js-standard-style License: MIT

Overview

This is an easy, basic and raw example of HOW to implement an API with Node, Express and PostgreSQL (with Sequelize ORM).

Requirements

  • Node 12+
  • NPM
  • PostgreSQL
  • Sequelize ORM
  • Optional: ElephantSQL account

Install dependencies

To avoid issues with husky, first enable git hooks (and add our hook):

npx husky install

npx husky add .husky/pre-commit

Then, install the dependencies as usual:

npm install

DB

Create database

createdb users

Populate data

psql users

Add data to users table

COPY users(id, firstname, lastname, age, gender, username, company, email, phone, address, created_at, updated_at)
FROM '/Users/your-user/data/node-express-postgresql/users.csv'
DELIMITER ','
CSV HEADER;

Dump data from local DB to external

pg_dump postgres://your-user:[email protected]/agency | psql postgres://your-user:[email protected]/your-database-name

Running the server

Development

npm run dev

Production

npm run build

npm start

API endpoints

GET /api/users

  • Returns an object with the key data containing an array of objects with 40 records.
  • Supports query string:
    • ?limit=integer
    • ?offset=integer

Request:

curl http://127.0.0.1:3333/api/users

Sample response:

{
  "data": [
    {
      "id": 1,
      "firstname": "Christian",
      "lastname": "Deackes",
      "age": 36,
      "gender": "Genderqueer",
      "username": "cdeackes0",
      "company": "Eayo",
      "email": "[email protected]",
      "phone": "602-240-5463",
      "address": "53 Lakewood Plaza",
      "createdAt": "2020-11-30T08:00:00.000Z",
      "updatedAt": "2021-03-28T07:00:00.000Z"
    },
    {
      "id": 2,
      "firstname": "Staford",
      "lastname": "Noice",
      "age": 27,
      "gender": "Female",
      "username": "snoice1",
      "company": "Oyoloo",
      "email": "[email protected]",
      "phone": "951-811-1800",
      "address": "18298 Crest Line Road",
      "createdAt": "2021-06-30T07:00:00.000Z",
      "updatedAt": "2021-07-14T07:00:00.000Z"
    }
  ]
}

Query string

GET /api/users?limit=1
  • Returns n record(s) where n is the value (type: Number) of the limit key.
Request:
curl http://127.0.0.1:3333/api/users?limit=1
Response:
{
  "data": [
    {
      "id": 1,
      "firstname": "Christian",
      "lastname": "Deackes",
      "age": 36,
      "gender": "Genderqueer",
      "username": "cdeackes0",
      "company": "Eayo",
      "email": "[email protected]",
      "phone": "602-240-5463",
      "address": "53 Lakewood Plaza",
      "createdAt": "2020-11-30T08:00:00.000Z",
      "updatedAt": "2021-03-28T07:00:00.000Z"
    },
  ]
}

Wrong type for n value will return all the users. Example: users?limit=%27Hello%27

GET /api/users?offset=10
  • Returns from n (PRIMARY KEY) where n is the value (type: Number) of the offset key.
Request:
curl http://127.0.0.1:3333/api/users?offset=10
Response:
{
  "data": [
    {
      "id": 11,
      "firstname": "Goldie",
      "lastname": "Dany",
      "age": 88,
      "gender": "Female",
      "username": "gdanya",
      "company": "Devcast",
      "email": "[email protected]",
      "phone": "954-161-7922",
      "address": "68 Drewry Plaza",
      "createdAt": "2021-03-28T07:00:00.000Z",
      "updatedAt": "2021-03-19T07:00:00.000Z"
    },
    {
      "id": 12,
      "firstname": "Kial",
      "lastname": "Hamberstone",
      "age": 53,
      "gender": "Male",
      "username": "khamberstoneb",
      "company": "Skipfire",
      "email": "[email protected]",
      "phone": "896-244-3662",
      "address": "68425 Buell Point",
      "createdAt": "2020-10-11T07:00:00.000Z",
      "updatedAt": "2021-06-02T07:00:00.000Z"
    }
  ]
}

GET /latency

  • Returns an object with a delay of 1 second (default)
  • Supports query string:
    • ?limit=integer
    • ?offset=integer

Request:

curl http://127.0.0.1:3333/latency

Response:

{
  "data": "Thanks for waiting 1 second"
}

Query string

GET /latency?delay=2000
  • Increases latency (delay) to n milliseconds where, min:1000 and max:4000. Default value: 1000ms.

Wrong type for n value will produce a default delay of 1000ms.

Request:
curl http://127.0.0.1:3333/latency?delay=2000
Response:
{
  "data": "Thanks for waiting 2 seconds"
}

GET everything else

  • Any other endpoint will retrieve an object

Request:

curl http://127.0.0.1:3333/

Response:

{
  "message": "Node.js, Express, and PostgreSQL API!"
}

node-express-postgresql's People

Contributors

aldiazok avatar alpersonalwebsite avatar bunchito avatar greenkeeper[bot] avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar

node-express-postgresql's Issues

WS-2021-0154 (Medium) detected in glob-parent-5.1.0.tgz

WS-2021-0154 - Medium Severity Vulnerability

Vulnerable Library - glob-parent-5.1.0.tgz

Extract the non-magic parent path from a glob string.

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.0.tgz

Path to dependency file: node-express-postgre/package.json

Path to vulnerable library: node-express-postgre/node_modules/glob-parent/package.json

Dependency Hierarchy:

  • eslint-6.8.0.tgz (Root Library)
    • glob-parent-5.1.0.tgz (Vulnerable Library)

Found in HEAD commit: f492c6cd17c7f57babb5687a9d0c405dee11220b

Found in base branch: master

Vulnerability Details

Regular Expression Denial of Service (ReDoS) vulnerability was found in glob-parent before 5.1.2.

Publish Date: 2021-01-27

URL: WS-2021-0154

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2

Release Date: 2021-01-27

Fix Resolution: glob-parent - 5.1.2


Step up your Open Source Security Game with WhiteSource here

WS-2022-0280 (Critical) detected in moment-timezone-0.5.34.tgz

WS-2022-0280 - Critical Severity Vulnerability

Vulnerable Library - moment-timezone-0.5.34.tgz

Parse and display moments in any timezone.

Library home page: https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.34.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/moment-timezone/package.json

Dependency Hierarchy:

  • sequelize-6.21.0.tgz (Root Library)
    • moment-timezone-0.5.34.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Command Injection in moment-timezone before 0.5.35.

Publish Date: 2022-08-30

URL: WS-2022-0280

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-56x4-j7p9-fcf9

Release Date: 2022-08-30

Fix Resolution (moment-timezone): 0.5.35

Direct dependency fix Resolution (sequelize): 6.21.1


Step up your Open Source Security Game with Mend here

CVE-2020-28469 (High) detected in glob-parent-5.1.0.tgz

CVE-2020-28469 - High Severity Vulnerability

Vulnerable Library - glob-parent-5.1.0.tgz

Extract the non-magic parent path from a glob string.

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.0.tgz

Path to dependency file: node-express-postgre/package.json

Path to vulnerable library: node-express-postgre/node_modules/glob-parent/package.json

Dependency Hierarchy:

  • eslint-6.8.0.tgz (Root Library)
    • glob-parent-5.1.0.tgz (Vulnerable Library)

Found in HEAD commit: f492c6cd17c7f57babb5687a9d0c405dee11220b

Found in base branch: master

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution: glob-parent - 5.1.2


Step up your Open Source Security Game with WhiteSource here

CVE-2020-15366 (Medium) detected in ajv-6.10.2.tgz

CVE-2020-15366 - Medium Severity Vulnerability

Vulnerable Library - ajv-6.10.2.tgz

Another JSON Schema Validator

Library home page: https://registry.npmjs.org/ajv/-/ajv-6.10.2.tgz

Path to dependency file: node-express-postgre/package.json

Path to vulnerable library: node-express-postgre/node_modules/ajv/package.json

Dependency Hierarchy:

  • eslint-6.8.0.tgz (Root Library)
    • ajv-6.10.2.tgz (Vulnerable Library)

Found in HEAD commit: f79775576b94c542e0e6d8c10e96faef43c5627c

Found in base branch: master

Vulnerability Details

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

Publish Date: 2020-07-15

URL: CVE-2020-15366

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/ajv-validator/ajv/releases/tag/v6.12.3

Release Date: 2020-07-15

Fix Resolution: ajv - 6.12.3


Step up your Open Source Security Game with WhiteSource here

CVE-2021-35065 (High) detected in glob-parent-5.1.2.tgz - autoclosed

CVE-2021-35065 - High Severity Vulnerability

Vulnerable Library - glob-parent-5.1.2.tgz

Extract the non-magic parent path from a glob string.

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

  • cli-7.17.10.tgz (Root Library)
    • chokidar-3.5.2.tgz
      • glob-parent-5.1.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package glob-parent from 6.0.0 and before 6.0.1 are vulnerable to Regular Expression Denial of Service (ReDoS)

Publish Date: 2021-06-22

URL: CVE-2021-35065

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cj88-88mr-972w

Release Date: 2021-06-22

Fix Resolution: glob-parent - 6.0.1


Step up your Open Source Security Game with Mend here

An in-range update of eslint-plugin-import is breaking the build 🚨


☝️ Important announcement: Greenkeeper will be saying goodbye 👋 and passing the torch to Snyk on June 3rd, 2020! Find out how to migrate to Snyk and more at greenkeeper.io


The devDependency eslint-plugin-import was updated from 2.20.1 to 2.20.2.

🚨 View failing branch.

This version is covered by your current version range and after updating it in your project the build failed.

eslint-plugin-import is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details
  • Travis CI - Branch: The build passed.
  • WhiteSource Security Check: The Security Check found 1 vulnerabilities.

Severity CVSS Score CVE GitHub Issue
High 7.5 CVE-2020-8116 #12

Scan token: 2169e09beb4c4172b3251e7db18e806a

Commits

The new version differs by 14 commits.

  • 71ca88f Bump to v2.20.2
  • a618f88 [Tests] pin esquery, due to breaking change in a minor version
  • 9c5899e utils: v2.6.0
  • efb5f07 [Tests] use babel instead of NODE_PATH
  • 1a3a128 [Fix] first: Add a way to disable absolute-first explicitly
  • efd6be1 [Fix] no-unused-modules: handle export { default } from syntax
  • adbced7 utils: [New] Print more helpful info if parsing fails
  • b6242b0 [fix] no-duplicates: fix fixer on cases with default import
  • 41aaa18 resolvers/node: [New] add .node extension
  • 12971f5 [Fix] order: recognize ".." as a "parent" path
  • 47f912e [Fix] order: fix isExternalModule detection on windows
  • 8905007 [Tests] appveyor: on node 8-12, use npm 6.10.3
  • 2beec94 [meta] use in-publish in prepublish
  • 1fbef73 [meta] fix changelog link

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.


Your Greenkeeper Bot 🌴

An in-range update of dotenv is breaking the build 🚨

The dependency dotenv was updated from 8.1.0 to 8.2.0.

🚨 View failing branch.

This version is covered by your current version range and after updating it in your project the build failed.

dotenv is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.

Status Details
  • WhiteSource Security Check: Oops! An error occurred while running the Security Check.

Please contact the WhiteSource Support team at [email protected] and mention the following scan token: 558f2d973b1a49dba01e4d837b107767 - ✅ **Travis CI - Branch:** The build **passed**.

Commits

The new version differs by 3 commits.

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.


Your Greenkeeper Bot 🌴

WS-2020-0070 (High) detected in lodash-4.17.15.tgz

WS-2020-0070 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /tmp/ws-scm/node-express-postgre/package.json

Path to vulnerable library: /tmp/ws-scm/node-express-postgre/node_modules/lodash/package.json

Dependency Hierarchy:

  • eslint-6.8.0.tgz (Root Library)
    • lodash-4.17.15.tgz (Vulnerable Library)

Found in HEAD commit: 0e6018ba0c759048cb86110f7e1a34b2c99b9bdc

Vulnerability Details

a prototype pollution vulnerability in lodash. It allows an attacker to inject properties on Object.prototype

Publish Date: 2020-04-28

URL: WS-2020-0070

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.


Step up your Open Source Security Game with WhiteSource here

WS-2022-0284 (Critical) detected in moment-timezone-0.5.34.tgz

WS-2022-0284 - Critical Severity Vulnerability

Vulnerable Library - moment-timezone-0.5.34.tgz

Parse and display moments in any timezone.

Library home page: https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.34.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/moment-timezone/package.json

Dependency Hierarchy:

  • sequelize-6.21.0.tgz (Root Library)
    • moment-timezone-0.5.34.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Cleartext Transmission of Sensitive Information in moment-timezone

Publish Date: 2022-08-30

URL: WS-2022-0284

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-v78c-4p63-2j6c

Release Date: 2022-08-30

Fix Resolution (moment-timezone): 0.5.35

Direct dependency fix Resolution (sequelize): 6.21.1


Step up your Open Source Security Game with Mend here

CVE-2020-8203 (High) detected in lodash-4.17.15.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: node-express-postgre/package.json

Path to vulnerable library: node-express-postgre/node_modules/lodash/package.json

Dependency Hierarchy:

  • eslint-6.8.0.tgz (Root Library)
    • lodash-4.17.15.tgz (Vulnerable Library)

Found in HEAD commit: f79775576b94c542e0e6d8c10e96faef43c5627c

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-10-21

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

CVE-2022-31129 (High) detected in moment-2.29.1.tgz

CVE-2022-31129 - High Severity Vulnerability

Vulnerable Library - moment-2.29.1.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.29.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/moment/package.json

Dependency Hierarchy:

  • sequelize-6.21.0.tgz (Root Library)
    • moment-2.29.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

Publish Date: 2022-07-06

URL: CVE-2022-31129

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wc69-rhjr-hc9g

Release Date: 2022-07-06

Fix Resolution (moment): 2.29.4

Direct dependency fix Resolution (sequelize): 6.21.1


Step up your Open Source Security Game with Mend here

CVE-2023-26132 (High) detected in dottie-2.0.2.tgz

CVE-2023-26132 - High Severity Vulnerability

Vulnerable Library - dottie-2.0.2.tgz

Fast and safe nested object access and manipulation in JavaScript

Library home page: https://registry.npmjs.org/dottie/-/dottie-2.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/dottie/package.json

Dependency Hierarchy:

  • sequelize-6.21.0.tgz (Root Library)
    • dottie-2.0.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.

Publish Date: 2023-06-10

URL: CVE-2023-26132

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26132

Release Date: 2023-06-10

Fix Resolution: dottie - 2.0.4


Step up your Open Source Security Game with Mend here

CVE-2023-22579 (High) detected in sequelize-6.21.0.tgz

CVE-2023-22579 - High Severity Vulnerability

Vulnerable Library - sequelize-6.21.0.tgz

Sequelize is a promise-based Node.js ORM tool for Postgres, MySQL, MariaDB, SQLite, Microsoft SQL Server, Amazon Redshift and Snowflake’s Data Cloud. It features solid transaction support, relations, eager and lazy loading, read replication and more.

Library home page: https://registry.npmjs.org/sequelize/-/sequelize-6.21.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/sequelize/package.json

Dependency Hierarchy:

  • sequelize-6.21.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.

Publish Date: 2023-02-16

URL: CVE-2023-22579

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-vqfx-gj96-3w95

Release Date: 2023-02-16

Fix Resolution: 6.28.1


Step up your Open Source Security Game with Mend here

CVE-2021-23343 (High) detected in path-parse-1.0.6.tgz

CVE-2021-23343 - High Severity Vulnerability

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: node-express-postgre/package.json

Path to vulnerable library: node-express-postgre/node_modules/path-parse/package.json

Dependency Hierarchy:

  • eslint-plugin-import-2.22.1.tgz (Root Library)
    • resolve-1.19.0.tgz
      • path-parse-1.0.6.tgz (Vulnerable Library)

Found in HEAD commit: f492c6cd17c7f57babb5687a9d0c405dee11220b

Found in base branch: master

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: jbgutierrez/path-parse#8

Release Date: 2021-05-04

Fix Resolution: path-parse - 1.0.7


Step up your Open Source Security Game with WhiteSource here

CVE-2021-3777 (High) detected in tmpl-1.0.4.tgz - autoclosed

CVE-2021-3777 - High Severity Vulnerability

Vulnerable Library - tmpl-1.0.4.tgz

JavaScript micro templates.

Library home page: https://registry.npmjs.org/tmpl/-/tmpl-1.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tmpl/package.json

Dependency Hierarchy:

  • babel-jest-26.6.3.tgz (Root Library)
    • transform-26.6.2.tgz
      • jest-haste-map-26.6.2.tgz
        • walker-1.0.7.tgz
          • makeerror-1.0.11.tgz
            • tmpl-1.0.4.tgz (Vulnerable Library)

Found in HEAD commit: 14f323dcad6382af4c36a845b42d942afa6dcea9

Found in base branch: master

Vulnerability Details

nodejs-tmpl is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-15

URL: CVE-2021-3777

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/daaku/nodejs-tmpl/releases/tag/v1.0.5

Release Date: 2021-09-15

Fix Resolution (tmpl): 1.0.5

Direct dependency fix Resolution (babel-jest): 27.0.0-next.0


Step up your Open Source Security Game with WhiteSource here

CVE-2021-44906 (High) detected in minimist-1.2.5.tgz - autoclosed

CVE-2021-44906 - High Severity Vulnerability

Vulnerable Library - minimist-1.2.5.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimist/package.json

Dependency Hierarchy:

  • eslint-friendly-formatter-4.0.1.tgz (Root Library)
    • minimist-1.2.5.tgz (Vulnerable Library)

Found in HEAD commit: 14f323dcad6382af4c36a845b42d942afa6dcea9

Found in base branch: master

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/substack/minimist/issues/164

Release Date: 2022-03-17

Fix Resolution: minimist - 1.2.6


Step up your Open Source Security Game with WhiteSource here

CVE-2023-22580 (High) detected in sequelize-6.21.0.tgz

CVE-2023-22580 - High Severity Vulnerability

Vulnerable Library - sequelize-6.21.0.tgz

Sequelize is a promise-based Node.js ORM tool for Postgres, MySQL, MariaDB, SQLite, Microsoft SQL Server, Amazon Redshift and Snowflake’s Data Cloud. It features solid transaction support, relations, eager and lazy loading, read replication and more.

Library home page: https://registry.npmjs.org/sequelize/-/sequelize-6.21.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/sequelize/package.json

Dependency Hierarchy:

  • sequelize-6.21.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure.

Publish Date: 2023-02-16

URL: CVE-2023-22580

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8c25-f3mj-v6h8

Release Date: 2023-02-16

Fix Resolution: 6.28.1


Step up your Open Source Security Game with Mend here

CVE-2021-23362 (Medium) detected in hosted-git-info-2.8.8.tgz

CVE-2021-23362 - Medium Severity Vulnerability

Vulnerable Library - hosted-git-info-2.8.8.tgz

Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab

Library home page: https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.8.tgz

Path to dependency file: node-express-postgre/package.json

Path to vulnerable library: node-express-postgre/node_modules/hosted-git-info/package.json

Dependency Hierarchy:

  • eslint-plugin-import-2.22.1.tgz (Root Library)
    • read-pkg-up-2.0.0.tgz
      • read-pkg-2.0.0.tgz
        • normalize-package-data-2.5.0.tgz
          • hosted-git-info-2.8.8.tgz (Vulnerable Library)

Found in HEAD commit: 1c2e7d37da6b0fe3f93b541e4b41747afaec6e1a

Found in base branch: master

Vulnerability Details

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Publish Date: 2021-03-23

URL: CVE-2021-23362

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-43f8-2h32-f4cj

Release Date: 2021-03-23

Fix Resolution: hosted-git-info - 2.8.9,3.0.8


Step up your Open Source Security Game with WhiteSource here

An in-range update of eslint-plugin-react is breaking the build 🚨

The devDependency eslint-plugin-react was updated from 7.14.0 to 7.14.1.

🚨 View failing branch.

This version is covered by your current version range and after updating it in your project the build failed.

eslint-plugin-react is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details
  • Travis CI - Branch: The build errored.
  • WhiteSource Security Check: Way to go! The Security Check did not find any vulnerabilities.
    Scan token: 27c8c2c6dcf44954a38868ee5df1f23a

Release Notes for v7.14.1

Fixed

  • Fix prop-types crash on multiple destructuring (#2319 @golopot)
Commits

The new version differs by 3 commits.

  • 62255af Update CHANGELOG and bump version
  • 655eb01 Merge pull request #2320 from golopot/issue-2319
  • 9639d82 [Fix] prop-types: fix crash on multiple destructuring

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.


Your Greenkeeper Bot 🌴

An in-range update of nodemon is breaking the build 🚨


🚨 Reminder! Less than one month left to migrate your repositories over to Snyk before Greenkeeper says goodbye on June 3rd! 💜 🚚💨 💚

Find out how to migrate to Snyk at greenkeeper.io


The devDependency nodemon was updated from 2.0.3 to 2.0.4.

🚨 View failing branch.

This version is covered by your current version range and after updating it in your project the build failed.

nodemon is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details
  • Travis CI - Branch: The build passed.
  • WhiteSource Security Check: The Security Check found 1 vulnerabilities.

Severity CVSS Score CVE GitHub Issue
High 8.1 WS-2020-0070 #16

Scan token: b7d9f0478b6947669f8da42780a985f9

Release Notes for v2.0.4

2.0.4 (2020-05-14)

Bug Fixes

Commits

The new version differs by 3 commits.

  • a74f5dc fix: add funding in package
  • 43def51 docs: Fix run-on sentence (#1704)
  • f18286e docs: update issue templates

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.


Your Greenkeeper Bot 🌴

CVE-2021-23337 (High) detected in lodash-4.17.15.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: node-express-postgre/package.json

Path to vulnerable library: node-express-postgre/node_modules/lodash/package.json

Dependency Hierarchy:

  • eslint-6.8.0.tgz (Root Library)
    • lodash-4.17.15.tgz (Vulnerable Library)

Found in HEAD commit: c3a8bd72bd1494ac15fa3c5246e28014b6ffe7a2

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

An in-range update of eslint-plugin-node is breaking the build 🚨

The devDependency eslint-plugin-node was updated from 9.1.0 to 9.2.0.

🚨 View failing branch.

This version is covered by your current version range and after updating it in your project the build failed.

eslint-plugin-node is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details
  • Travis CI - Branch: The build passed.
  • WhiteSource Security Check: Oops! An error occurred while running the Security Check.

Please contact the WhiteSource Support team at [email protected] and mention the following scan token: 50de69ad97fa43b5a83012f6d9d3b4f9

Commits

The new version differs by 9 commits.

  • 9fbdaec 🔖 9.2.0
  • c1d5dbf ✨ add no-callback-literal rule (#179)
  • 72de3a3 🐛 vulnerability fix: update eslint-utils to ^1.4.2 & eslint-plugin-es to ^1.4.1 (fixes #180) (#183)
  • cfc6352 🎨 fix typos in function names (#177)
  • b757c3e ⚒ improve azure-pipelines.yml (#173)
  • a85d541 ⚒ trivial fix
  • 88829af ⚒ Update azure-pipelines.yml for codecov (#170)
  • 5b3f815 🐛 fix for ESLint 6 (#169)
  • fe73872 ⚒ Switch to Azure Pipelines (#168)

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.


Your Greenkeeper Bot 🌴

CVE-2022-24785 (High) detected in moment-2.29.1.tgz

CVE-2022-24785 - High Severity Vulnerability

Vulnerable Library - moment-2.29.1.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.29.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/moment/package.json

Dependency Hierarchy:

  • sequelize-6.21.0.tgz (Root Library)
    • moment-2.29.1.tgz (Vulnerable Library)

Found in HEAD commit: 14f323dcad6382af4c36a845b42d942afa6dcea9

Found in base branch: master

Vulnerability Details

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Publish Date: 2022-04-04

URL: CVE-2022-24785

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8hfj-j24r-96c4

Release Date: 2022-04-04

Fix Resolution (moment): 2.29.2

Direct dependency fix Resolution (sequelize): 6.21.1


Step up your Open Source Security Game with Mend here

CVE-2021-44907 (Low) detected in qs-6.9.7.tgz - autoclosed

CVE-2021-44907 - Low Severity Vulnerability

Vulnerable Library - qs-6.9.7.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.9.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Dependency Hierarchy:

  • express-4.17.3.tgz (Root Library)
    • qs-6.9.7.tgz (Vulnerable Library)

Found in HEAD commit: 362cc433e4f25c4f38d41ab9f5b30507718fb4b2

Found in base branch: master

Vulnerability Details

A Denial of Service vulnerability exists in qs up to 6.8.0 due to insufficient sanitization of property in the gs.parse function. The merge() function allows the assignment of properties on an array in the query. For any property being assigned, a value in the array is converted to an object containing these properties. Essentially, this means that the property whose expected type is Array always has to be checked with Array.isArray() by the user. This may not be obvious to the user and can cause unexpected behavior.
WhiteSource Note: After conducting further research, WhiteSource has determined that versions 0.0.1--6.10.3 of qs are vulnerable to CVE-2021-44907.

Publish Date: 2022-03-17

URL: CVE-2021-44907

CVSS 3 Score Details (3.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.


Step up your Open Source Security Game with WhiteSource here

CVE-2021-3807 (High) detected in multiple libraries - autoclosed

CVE-2021-3807 - High Severity Vulnerability

Vulnerable Libraries - ansi-regex-4.1.0.tgz, ansi-regex-3.0.0.tgz, ansi-regex-5.0.0.tgz

ansi-regex-4.1.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/table/node_modules/ansi-regex/package.json,/node_modules/eslint/node_modules/ansi-regex/package.json

Dependency Hierarchy:

  • eslint-6.8.0.tgz (Root Library)
    • strip-ansi-5.2.0.tgz
      • ansi-regex-4.1.0.tgz (Vulnerable Library)
ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/eslint-friendly-formatter/node_modules/ansi-regex/package.json

Dependency Hierarchy:

  • eslint-friendly-formatter-4.0.1.tgz (Root Library)
    • strip-ansi-4.0.0.tgz
      • ansi-regex-3.0.0.tgz (Vulnerable Library)
ansi-regex-5.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/string-width/node_modules/ansi-regex/package.json,/node_modules/pretty-format/node_modules/ansi-regex/package.json,/node_modules/wrap-ansi/node_modules/ansi-regex/package.json,/node_modules/cliui/node_modules/ansi-regex/package.json,/node_modules/@jest/core/node_modules/ansi-regex/package.json,/node_modules/string-length/node_modules/ansi-regex/package.json,/node_modules/inquirer/node_modules/ansi-regex/package.json

Dependency Hierarchy:

  • eslint-6.8.0.tgz (Root Library)
    • inquirer-7.3.3.tgz
      • strip-ansi-6.0.0.tgz
        • ansi-regex-5.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 14f323dcad6382af4c36a845b42d942afa6dcea9

Found in base branch: master

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution (ansi-regex): 4.1.1

Direct dependency fix Resolution (eslint): 7.16.0

Fix Resolution (ansi-regex): 5.0.1

Direct dependency fix Resolution (eslint): 7.0.0-alpha.0


Step up your Open Source Security Game with WhiteSource here

An in-range update of pg is breaking the build 🚨

The dependency pg was updated from 7.15.0 to 7.15.1.

🚨 View failing branch.

This version is covered by your current version range and after updating it in your project the build failed.

pg is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.

Status Details
  • Travis CI - Branch: The build passed.
  • WhiteSource Security Check: Oops! An error occurred while running the Security Check.

Please contact the WhiteSource Support team at [email protected] and mention the following scan token: 8c5e3503336646d4a20d43841166697b

Commits

The new version differs by 99 commits.

  • cccf84e Publish
  • 69f30df Merge pull request #2030 from brianc/bmc/add-pg-cursor
  • b14cf67 Remove postgres 9.1 from test matrix - json is not supported
  • 57177d7 Use public npm - accidentally had my work npm configured
  • 5c0c93c Remove nested travis file
  • 423baa6 Update lint rules for pg-cursor
  • 37d1574 Add 'packages/pg-cursor/' from commit '492fbdbb65f6f33396d1017fa4cdbbb247dd3895'
  • 492fbdb Merge branch 'juneidysoo-master'
  • e20d012 Merge branch 'master' of https://github.com/juneidysoo/node-pg-cursor into juneidysoo-master
  • e34c602 Merge pull request #32 from hetul/fix-closing-finished-connections
  • 124c89b fix lint issues
  • 3790609 Bump version
  • 5055b3a Merge pull request #58 from brianc/bmc/add-test-and-deprecate-method
  • cedce4b Fix lint & enable all tests
  • 507c7ea Merge branch 'master' into bmc/add-test-and-deprecate-method

There are 99 commits in total.

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.


Your Greenkeeper Bot 🌴

CVE-2020-8116 (Medium) detected in dot-prop-4.2.0.tgz

CVE-2020-8116 - Medium Severity Vulnerability

Vulnerable Library - dot-prop-4.2.0.tgz

Get, set, or delete a property from a nested object using a dot path

Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-4.2.0.tgz

Path to dependency file: /tmp/ws-scm/node-express-postgre/package.json

Path to vulnerable library: /tmp/ws-scm/node-express-postgre/node_modules/dot-prop/package.json

Dependency Hierarchy:

  • nodemon-2.0.2.tgz (Root Library)
    • update-notifier-2.5.0.tgz
      • configstore-3.1.2.tgz
        • dot-prop-4.2.0.tgz (Vulnerable Library)

Found in HEAD commit: e0ce2bd853e906818484ba53199569f35b4c97af

Vulnerability Details

Prototype pollution vulnerability in dot-prop npm package version 5.1.0 and earlier allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

Publish Date: 2020-02-04

URL: CVE-2020-8116

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8116

Release Date: 2020-02-04

Fix Resolution: dot-prop - 5.1.1


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7598 (Medium) detected in minimist-0.0.8.tgz

CVE-2020-7598 - Medium Severity Vulnerability

Vulnerable Library - minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: node-express-postgre/package.json

Path to vulnerable library: node-express-postgre/node_modules/mkdirp/node_modules/minimist/package.json

Dependency Hierarchy:

  • eslint-6.8.0.tgz (Root Library)
    • mkdirp-0.5.1.tgz
      • minimist-0.0.8.tgz (Vulnerable Library)

Found in HEAD commit: f79775576b94c542e0e6d8c10e96faef43c5627c

Found in base branch: master

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/substack/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94

Release Date: 2020-03-11

Fix Resolution: minimist - 0.2.1,1.2.3


Step up your Open Source Security Game with WhiteSource here

An in-range update of eslint is breaking the build 🚨

The devDependency eslint was updated from 6.2.1 to 6.2.2.

🚨 View failing branch.

This version is covered by your current version range and after updating it in your project the build failed.

eslint is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details
  • WhiteSource Security Check: Oops! An error occurred while running the Security Check.

Please contact the WhiteSource Support team at [email protected] and mention the following scan token: 43257423484947cc89e84a7e107df8ca - ✅ **Travis CI - Branch:** The build **passed**.

Release Notes for v6.2.2
  • 0e0b784 Upgrade: espree@^6.1.1 (#12158) (Kevin Partington)
  • 04e859f Sponsors: Sync README with website (ESLint Jenkins)
  • 34783d1 Sponsors: Sync README with website (ESLint Jenkins)
  • b809e72 Docs: Update README team and sponsors (ESLint Jenkins)
Commits

The new version differs by 6 commits.

  • ca658fb 6.2.2
  • 3ed9f76 Build: changelog update for 6.2.2
  • 0e0b784 Upgrade: espree@^6.1.1 (#12158)
  • 04e859f Sponsors: Sync README with website
  • 34783d1 Sponsors: Sync README with website
  • b809e72 Docs: Update README team and sponsors

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.


Your Greenkeeper Bot 🌴

CVE-2020-28500 (Medium) detected in lodash-4.17.15.tgz

CVE-2020-28500 - Medium Severity Vulnerability

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: node-express-postgre/package.json

Path to vulnerable library: node-express-postgre/node_modules/lodash/package.json

Dependency Hierarchy:

  • eslint-6.8.0.tgz (Root Library)
    • lodash-4.17.15.tgz (Vulnerable Library)

Found in HEAD commit: c3a8bd72bd1494ac15fa3c5246e28014b6ffe7a2

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution: lodash-4.17.21


Step up your Open Source Security Game with WhiteSource here

CVE-2023-22578 (Critical) detected in sequelize-6.21.0.tgz

CVE-2023-22578 - Critical Severity Vulnerability

Vulnerable Library - sequelize-6.21.0.tgz

Sequelize is a promise-based Node.js ORM tool for Postgres, MySQL, MariaDB, SQLite, Microsoft SQL Server, Amazon Redshift and Snowflake’s Data Cloud. It features solid transaction support, relations, eager and lazy loading, read replication and more.

Library home page: https://registry.npmjs.org/sequelize/-/sequelize-6.21.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/sequelize/package.json

Dependency Hierarchy:

  • sequelize-6.21.0.tgz (Vulnerable Library)

Found in HEAD commit: 14f323dcad6382af4c36a845b42d942afa6dcea9

Found in base branch: master

Vulnerability Details

Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.

Publish Date: 2023-02-16

URL: CVE-2023-22578

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f598-mfpv-gmfx

Release Date: 2023-02-16

Fix Resolution: 6.29.0


Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.