Repository Summary

⚠️ CRITICAL	🔴 HIGH	🔵 MEDIUM	⚪ LOW
16	68	84	0

package.json

⚠️ CRITICAL	🔴 HIGH	🔵 MEDIUM	⚪ LOW
16	68	84	0

1 vulnerability found in crypto-js package

View Vulnerabilities

Severity	Exploitability Score	Priority	Issue	Found in	Fixed in
CRITICAL		Negligible	crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard	<4.2.0	4.2.0

1 vulnerability found in react-scripts package

View Vulnerabilities

Severity	Exploitability Score	Priority	Issue	Found in	Fixed in
CRITICAL		Negligible	Vulnerability found in package react-scripts	>=0.1.0	N/A

1 vulnerability found in aws-amplify package

View Vulnerabilities

Severity	Exploitability Score	Priority	Issue	Found in	Fixed in
HIGH		Negligible	Vulnerability found in package aws-amplify	2.2.8-unstable.0 - 4.2.6-unstable.4	N/A

1 vulnerability found in react package

View Vulnerabilities

Severity	Exploitability Score	Priority	Issue	Found in	Fixed in
HIGH		Negligible	Vulnerability found in package react	0.15.0-alpha.1 - 16.4.2	18.2.0

1 vulnerability found in react-dom package

View Vulnerabilities

Severity	Exploitability Score	Priority	Issue	Found in	Fixed in
HIGH		Negligible	Vulnerability found in package react-dom	15.4.0-rc.1 - 16.4.2	18.2.0

1 vulnerability found in react-markdown package

View Vulnerabilities

Severity	Exploitability Score	Priority	Issue	Found in	Fixed in
HIGH		Negligible	Vulnerability found in package react-markdown	3.0.0-rc1 - 4.3.1	N/A

1 vulnerability found in react-web-share-api package

View Vulnerabilities

Severity	Exploitability Score	Priority	Issue	Found in	Fixed in
HIGH		Negligible	Vulnerability found in package react-web-share-api	*	0.0.2

1 vulnerability found in browserslist package

View Vulnerabilities

Severity	Exploitability Score	Priority	Issue	Found in	Fixed in
MEDIUM		Negligible	Regular Expression Denial of Service in browserslist	4.0.0 - 4.16.4	N/A

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

• fix(deps): update dependency @stripe/stripe-js to v3
• fix(deps): update dependency aws-amplify to v6
• fix(deps): update dependency query-string to v9
• fix(deps): update dependency react-bootstrap to v2
• fix(deps): update dependency react-markdown to v9
• fix(deps): update dependency react-router-dom to v6
• fix(deps): update dependency react-scripts to v5
• fix(deps): update react monorepo to v18 (major) (react, react-dom)
• fix(deps): update testing-library monorepo (major) (@testing-library/jest-dom, @testing-library/react, @testing-library/user-event)
• 🔐 Create all rate-limited PRs at once 🔐

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• fix(deps): update dependency crypto-js to v4.2.0 [security]
• fix(deps): update dependency react-scripts to v4.0.3
• fix(deps): update dependency @sentry/browser to v5.30.0
• fix(deps): update dependency @stripe/stripe-js to v1.54.2
• fix(deps): update dependency aws-amplify to v3.4.3
• fix(deps): update dependency query-string to v6.14.1
• fix(deps): update dependency react-router-bootstrap to ^0.26.0
• fix(deps): update dependency react-router-dom to v5.3.4
• fix(deps): update react monorepo to v16.14.0 (react, react-dom)
• fix(deps): update dependency @sentry/browser to v7
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

npm

package.json

• @sentry/browser ^5.22.3
• @stripe/stripe-js ^1.10.0
• @testing-library/jest-dom ^4.2.4
• @testing-library/react ^9.5.0
• @testing-library/user-event ^7.2.1
• aws-amplify ^3.0.23
• crypto-js ^4.0.0
• query-string ^6.13.7
• react ^16.13.1
• react-bootstrap ^0.33.1
• react-clipboard.js ^2.0.16
• react-dom ^16.13.1
• react-markdown ^4.3.1
• react-router-bootstrap ^0.25.0
• react-router-dom ^5.2.0
• react-scripts 4.0.0
• react-stripe-elements ^6.1.2
• react-web-share-api 0.0.2
• zxcvbn ^4.4.2

---

• Check this box to trigger a request for Renovate to run again on this repository

3 potential secrets found in repository

🔑 Private Key	🔒 Generic API Key	☁️ Cloud API Key	💬 Slack token
0	1	0	0

Stripe Access Token

Stripe Access Token

Generic API Key

2 Potential vulnerability sources found in JavaScript files within this repo

⚠️ CRITICAL	🔴 HIGH	🔵 MEDIUM	⚪ LOW
0	0	2	0

Nullify Code - JavaScript 🔵 MEDIUM Severity CWE-327

Node insecure random generator

crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator.

Nullify Code - JavaScript 🔵 MEDIUM Severity CWE-327

Node insecure random generator

crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator.

1 Potential vulnerability sources found in Renovate files within this repo

⚠️ CRITICAL	🔴 HIGH	🔵 MEDIUM	⚪ LOW
0	0	1	0

Nullify Code - Renovate 🔵 MEDIUM Severity

Missing docker.pinDigests setting in renovate

https://github.com/ciaran-finnegan/secret-sharer-client/blob/3e30e1436319254df4cd35c4f6c41377649d33f3/renovate.json#L1-L0