Code Monkey home page Code Monkey logo

alexrogalskiy / scala-patterns Goto Github PK

View Code? Open in Web Editor NEW
2.0 3.0 0.0 13.25 MB

๐Ÿ† Scala4You Design patterns

Home Page: https://alexander-rogalsky.gitbook.io/scala-patterns/

License: GNU General Public License v3.0

Shell 28.36% JavaScript 6.80% Dockerfile 9.52% Starlark 24.70% Open Policy Agent 6.15% Python 8.87% Go 4.89% Makefile 6.79% Mustache 3.76% Vim Script 0.15%
scala ebook patterns-design patterns scala-library scala-programming-language

scala-patterns's Introduction

Scala Design Patterns

Scala Design patterns

Nullable labs Scala patterns Scala patterns

GitHub tag (latest by date) GitHub Release Date Lines of code GitHub closed issues GitHub closed pull requests GitHub repo size GitHub last commit GitHub GitHub language count GitHub search hit counter GitHub Repository branches GitHub Repository dependents

FOSSA Status Renovatebot Dependabot NewReleases Hits-of-Code ComVer GitHub Super-Linter Documentation Status NetflixOSS Lifecycle CI

๐ŸŽน Table of contents

โ˜ Summary

Scala Project Status: Active โ€“ The project has reached a stable, usable state and is being actively developed. Project created status Project updated status

Scala Design Patterns is intended to provide various use case scenarios and architectural concepts on prototyping adaptive applications.

mkdocs.yml    # Configuration file.
docs/
    readme.md  # General information
    summary.md  # Table of contents
    units/
        design-patterns.md # Design patterns and architectural concepts
        scenarios.md # Scenarios in practice
        use-cases.md # Typical use cases 
    user-guide/
        changelog.md # Changelog page 
        code_of_conduct.md # Code of conduct page 
        code_owners.md # Code owners page 
        dependency.md # Dependency page 
        description.md # Description page
        faq.md # FAQ page
        getting-started.md # Getting started page
        troubleshooting.md # Troubleshooting page
        upgrade.md # Upgrade page
    reporting/
        info.md # Informational page
        issue_template.md # Issue template page
        bug_report.md # Bug report template
        custom_report.md # Custom report template
        feature_request_template.md # Feature request template
        pull_request_template.md # Pull request template
    contributing/
        info.md # Contributing page
    links/
        info.md # Links page

๐Ÿ“ Documentation

The Website documentation is provided by gitbook and can be discovered at url:

Scala Patterns

To enable documentation serving at localhost you can run the following script

./scripts/build-docs.sh

otherwise, the next steps should be considered:

1) Install/upgrade pip command-line utility:

pip install --upgrade pip

or if you need to install pip for the first time:

wget --no-check-certificate https://bootstrap.pypa.io/get-pip.py
python get-pip.py

2) Install the mkdocs package using pip:

pip install mkdocs

or more conveniently for Windows subsystem:

python -m pip install mkdocs
python -m mkdocs

3) Install the material theme for the website:

python -m pip install mkdocs-material
python -m pip install markdown-include
...
(see requirements.txt)
...

4) Start the server at localhost by running the following command:

python -m mkdocs build --clean --config-file mkdocs.yml
python -m mkdocs serve --verbose --dirtyreload

5) Deploy to GitHub pages:

python -m mkdocs --verbose gh-deploy --force --remote-branch gh-pages

5) Open up localhost in browser to get the default documentation homepage.

๐Ÿงถ Kubernetes

Running k8s cluster with tilt command by acquiring k8s deployment configuration:

tilt up

Shutting down k8s cluster with provisioned resources removal:

tilt down --delete-namespaces

โฐ Statistics

Documentation PageSpeed result dashboard

๐Ÿ“ Versioning

The project uses SemVer for versioning. For the versions available, see the tags on this repository.

๐ŸŒน Authors

Scala Patterns is maintained by the following GitHub team-members:

  • Author

with community support please contact with us if you have some question or proposition.

๐Ÿ’• Contributing

Contributors Display

Please read CONTRIBUTING.md for details on our code of conduct, and the process for submitting pull requests to us (emoji key).

This project follows the all-contributors specification. Contributions of any kind are welcome!

PRs Welcome Github contributors

See also the list of contributors who participated in this project.

๐Ÿšจ Visitor stats

GitHub page hits

GitHub stars GitHub forks GitHub watchers

โšฝ Licensing

Scala Patterns is distributed under LGPL version 3 or later, [License]. LGPLv3 is additional permissions on top of GPLv3.

image

๐ŸŒŸ Development Support

Like Scala Design patterns and Scala Patterns ? Consider buying me a coffee :)

Become a Patron Buy Me A Coffee KoFi

๐Ÿ‘จโ€๐Ÿ‘จโ€๐Ÿ‘งโ€๐Ÿ‘ฆ Acknowledgement

Stargazers repo roster for @AlexRogalskiy/scala-patterns

Stargazers over time

Statistics report

๐Ÿ“Ž OpenGraph Card

OpenGraph card

๐Ÿ”ฅ Feeds and Podcasts

Reddit posts

InfoWorld posts

RedHat posts

Akka posts

Li Haoyi posts

Scala Lang posts

Scalac posts


forthebadge forthebadge forthebadge

scala-patterns's People

Contributors

alexrogalskiy avatar dependabot[bot] avatar github-actions[bot] avatar mend-bolt-for-github[bot] avatar renovate-bot avatar

Stargazers

 avatar  avatar

Watchers

 avatar  avatar  avatar

scala-patterns's Issues

CVE-2019-1010266 (Medium) detected in lodash-2.4.2.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 3345ab4606b48f21fc32171dfe8507f2b63ef27d

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8203 (High) detected in lodash-2.4.2.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: a2038481c733ecc5f23a278821dc4e3950b74d05

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-10-21

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-2.4.2.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: cbfc88dbae3efca916b4a507fecb8a7c73d5a440

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8203 (High) detected in lodash-2.4.2.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: cbfc88dbae3efca916b4a507fecb8a7c73d5a440

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-10-21

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8203 (High) detected in lodash-2.4.2.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-10-21

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-2.4.2.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 3345ab4606b48f21fc32171dfe8507f2b63ef27d

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8203 (High) detected in lodash-2.4.2.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 788568b6597a7b8fd1d24aee207df9460fba31a9

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-10-21

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1010266 (Medium) detected in lodash-2.4.2.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • remark-preset-davidtheclark-0.12.0.tgz (Root Library)
    • remark-cli-7.0.1.tgz
      • remark-11.0.2.tgz
        • remark-parse-7.0.2.tgz
          • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 788568b6597a7b8fd1d24aee207df9460fba31a9

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2021-33623 (High) detected in trim-newlines-1.0.0.tgz

CVE-2021-33623 - High Severity Vulnerability

Vulnerable Library - trim-newlines-1.0.0.tgz

Trim newlines from the start and/or end of a string

Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-1.0.0.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/get-pkg-repo/node_modules/trim-newlines/package.json

Dependency Hierarchy:

  • conventional-changelog-cli-2.1.1.tgz (Root Library)
    • conventional-changelog-3.1.24.tgz
      • conventional-changelog-core-4.2.2.tgz
        • get-pkg-repo-1.4.0.tgz
          • meow-3.7.0.tgz
            • โŒ trim-newlines-1.0.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

Publish Date: 2021-05-28

URL: CVE-2021-33623

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623

Release Date: 2021-05-28

Fix Resolution: trim-newlines - 3.0.1, 4.0.1


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: a2038481c733ecc5f23a278821dc4e3950b74d05

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2018-3721 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 3345ab4606b48f21fc32171dfe8507f2b63ef27d

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • remark-preset-davidtheclark-0.12.0.tgz (Root Library)
    • remark-cli-7.0.1.tgz
      • remark-11.0.2.tgz
        • remark-parse-7.0.2.tgz
          • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 4165d38367ee251b5aceb7c9d1be22af1595df8c

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2018-3721 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: a2038481c733ecc5f23a278821dc4e3950b74d05

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in lodash-2.4.2.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 3345ab4606b48f21fc32171dfe8507f2b63ef27d

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2018-3721 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: cbfc88dbae3efca916b4a507fecb8a7c73d5a440

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: 966298c010f70ad26d109a6cf0b767c2eed2d25f

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2018-3721 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5


Step up your Open Source Security Game with WhiteSource here

CVE-2021-33623 (High) detected in trim-newlines-1.0.0.tgz

CVE-2021-33623 - High Severity Vulnerability

Vulnerable Library - trim-newlines-1.0.0.tgz

Trim newlines from the start and/or end of a string

Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-1.0.0.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/get-pkg-repo/node_modules/trim-newlines/package.json

Dependency Hierarchy:

  • conventional-changelog-cli-2.1.1.tgz (Root Library)
    • conventional-changelog-3.1.24.tgz
      • conventional-changelog-core-4.2.2.tgz
        • get-pkg-repo-1.4.0.tgz
          • meow-3.7.0.tgz
            • โŒ trim-newlines-1.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 788568b6597a7b8fd1d24aee207df9460fba31a9

Found in base branch: master

Vulnerability Details

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

Publish Date: 2021-05-28

URL: CVE-2021-33623

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623

Release Date: 2021-05-28

Fix Resolution: trim-newlines - 3.0.1, 4.0.1


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1010266 (Medium) detected in lodash-2.4.2.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: a2038481c733ecc5f23a278821dc4e3950b74d05

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2021-33623 (High) detected in trim-newlines-1.0.0.tgz

CVE-2021-33623 - High Severity Vulnerability

Vulnerable Library - trim-newlines-1.0.0.tgz

Trim newlines from the start and/or end of a string

Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-1.0.0.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/get-pkg-repo/node_modules/trim-newlines/package.json

Dependency Hierarchy:

  • conventional-changelog-cli-2.1.1.tgz (Root Library)
    • conventional-changelog-3.1.24.tgz
      • conventional-changelog-core-4.2.2.tgz
        • get-pkg-repo-1.4.0.tgz
          • meow-3.7.0.tgz
            • โŒ trim-newlines-1.0.0.tgz (Vulnerable Library)

Found in HEAD commit: cbfc88dbae3efca916b4a507fecb8a7c73d5a440

Found in base branch: master

Vulnerability Details

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

Publish Date: 2021-05-28

URL: CVE-2021-33623

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623

Release Date: 2021-05-28

Fix Resolution: trim-newlines - 3.0.1, 4.0.1


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • textlint-rule-alex-1.3.1.tgz (Root Library)
    • alex-5.1.0.tgz
      • remark-parse-4.0.0.tgz
        • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: a2038481c733ecc5f23a278821dc4e3950b74d05

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: cbfc88dbae3efca916b4a507fecb8a7c73d5a440

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in lodash-2.4.2.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 788568b6597a7b8fd1d24aee207df9460fba31a9

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in lodash-2.4.2.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: cbfc88dbae3efca916b4a507fecb8a7c73d5a440

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-2.4.2.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 788568b6597a7b8fd1d24aee207df9460fba31a9

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: 4165d38367ee251b5aceb7c9d1be22af1595df8c

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8203 (High) detected in lodash-2.4.2.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 3345ab4606b48f21fc32171dfe8507f2b63ef27d

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-10-21

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-2.4.2.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 3345ab4606b48f21fc32171dfe8507f2b63ef27d

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in lodash-2.4.2.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1010266 (Medium) detected in lodash-2.4.2.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 788568b6597a7b8fd1d24aee207df9460fba31a9

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • alex-9.1.0.tgz (Root Library)
    • remark-parse-8.0.3.tgz
      • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 3345ab4606b48f21fc32171dfe8507f2b63ef27d

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2020-15366 (Medium) detected in ajv-4.11.8.tgz

CVE-2020-15366 - Medium Severity Vulnerability

Vulnerable Library - ajv-4.11.8.tgz

Another JSON Schema Validator

Library home page: https://registry.npmjs.org/ajv/-/ajv-4.11.8.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/@textlint/linter-formatter/node_modules/ajv/package.json

Dependency Hierarchy:

  • textlint-11.9.1.tgz (Root Library)
    • linter-formatter-3.3.5.tgz
      • table-3.8.3.tgz
        • โŒ ajv-4.11.8.tgz (Vulnerable Library)

Found in HEAD commit: a2038481c733ecc5f23a278821dc4e3950b74d05

Found in base branch: master

Vulnerability Details

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

Publish Date: 2020-07-15

URL: CVE-2020-15366

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/ajv-validator/ajv/releases/tag/v6.12.3

Release Date: 2020-07-15

Fix Resolution: ajv - 6.12.3


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-2.4.2.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: a2038481c733ecc5f23a278821dc4e3950b74d05

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: 3345ab4606b48f21fc32171dfe8507f2b63ef27d

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • remark-preset-davidtheclark-0.12.0.tgz (Root Library)
    • remark-cli-7.0.1.tgz
      • remark-11.0.2.tgz
        • remark-parse-7.0.2.tgz
          • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 966298c010f70ad26d109a6cf0b767c2eed2d25f

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in lodash-2.4.2.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: a2038481c733ecc5f23a278821dc4e3950b74d05

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0


Step up your Open Source Security Game with WhiteSource here

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Repository problems

These problems occurred while renovating this repository. View logs.

  • WARN: Package lookup failures

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

  • โฌ†๏ธ Updates alex to ^9.1.1
  • โฌ†๏ธ Updates anchore/scan-action action to v1.0.10
  • โฌ†๏ธ Updates dumb-init to >=1.2.5.post1
  • โฌ†๏ธ Updates markdown-checklist to >=0.4.4
  • โฌ†๏ธ Updates sangonzal/repository-traffic-action action to v0.1.5
  • โฌ†๏ธ Updates textlint-rule-en-capitalization to ^2.0.3
  • โฌ†๏ธ Updates textlint-rule-terminology to ^2.1.6
  • โฌ†๏ธ Updates yogevbd/enforce-label-action action to v2.2.2
  • โฌ†๏ธ Updates LouisBrunner/checks-action action to v1.6.2
  • โฌ†๏ธ Updates Node.js
  • โฌ†๏ธ Updates conventional-changelog-cli to ^2.2.2
  • โฌ†๏ธ Updates dessant/lock-threads action to v2.1.2
  • โฌ†๏ธ Updates git-cz to ^4.9.0
  • โฌ†๏ธ Updates helm/chart-releaser-action action to v1.6.0
  • โฌ†๏ธ Updates helm/chart-testing-action action to v2.6.1
  • โฌ†๏ธ Updates helm/kind-action action to v1.10.0
  • โฌ†๏ธ Updates ibiqlik/action-yamllint action to v3.1.1
  • โฌ†๏ธ Updates lint-staged to ^11.3.0-beta.2
  • โฌ†๏ธ Updates markdown to >=3.6
  • โฌ†๏ธ Updates markdown-include to >=0.8.1
  • โฌ†๏ธ Updates markdown-link-check to ^3.12.1
  • โฌ†๏ธ Updates markdownlint-cli to ^0.40.0
  • โฌ†๏ธ Updates mdx-truly-sane-lists to >=1.3
  • โฌ†๏ธ Updates mkdocs to >=1.6.0
  • โฌ†๏ธ Updates mkdocs-awesome-pages-plugin to >=2.9.2
  • โฌ†๏ธ Updates mkdocs-git-revision-date-localized-plugin to >=0.12.1
  • โฌ†๏ธ Updates mkdocs-include-markdown-plugin to >=3.9.1
  • โฌ†๏ธ Updates mkdocs-material to >=7.3.6
  • โฌ†๏ธ Updates mkdocs-material-extensions to >=1.3.1
  • โฌ†๏ธ Updates mkdocs-redirects to >=1.2.1
  • โฌ†๏ธ Updates node to v14.21.3
  • โฌ†๏ธ Updates prettier to ^2.8.8
  • โฌ†๏ธ Updates pretty-quick to ^3.3.1
  • โฌ†๏ธ Updates pygments to >=2.18.0
  • โฌ†๏ธ Updates python-markdown-math to >=0.8
  • โฌ†๏ธ Updates release-it to ^14.14.3
  • โฌ†๏ธ Updates repo-link-check to ^0.14.2
  • โฌ†๏ธ Updates stefanprodan/helm-gh-pages action to v1.7.0
  • โฌ†๏ธ Updates stylelint-scss to ^3.21.0
  • โฌ†๏ธ Updates textlint to ^12.6.1
  • โฌ†๏ธ Updates tretuna/sync-branches action to v1.4.0
  • โฌ†๏ธ Updates yaml-lint to ^1.7.0
  • โฌ†๏ธ Updates EndBug/add-and-commit action to v9
  • โฌ†๏ธ Updates LouisBrunner/checks-action action to v2
  • โฌ†๏ธ Updates Node.js to v20
  • โฌ†๏ธ Updates actions/cache action to v4
  • โฌ†๏ธ Updates actions/checkout action to v4
  • โฌ†๏ธ Updates actions/github-script action to v4
  • โฌ†๏ธ Updates actions/labeler action to v5
  • โฌ†๏ธ Updates actions/setup-node action to v4
  • โฌ†๏ธ Updates actions/setup-python action to v5
  • โฌ†๏ธ Updates actions/stale action to v9
  • โฌ†๏ธ Updates actions/upload-artifact action to v4
  • โฌ†๏ธ Updates alex to v11
  • โฌ†๏ธ Updates anchore/scan-action action to v3
  • โฌ†๏ธ Updates azure/setup-helm action to v4
  • โฌ†๏ธ Updates conventional-changelog-cli to v5
  • โฌ†๏ธ Updates cookiecutter to v2
  • โฌ†๏ธ Updates crazy-max/ghaction-github-labeler action to v5
  • โฌ†๏ธ Updates dessant/lock-threads action to v5
  • โฌ†๏ธ Updates docker/build-push-action action to v5
  • โฌ†๏ธ Updates docker/login-action action to v3
  • โฌ†๏ธ Updates docker/setup-buildx-action action to v3
  • โฌ†๏ธ Updates docker/setup-qemu-action action to v3
  • โฌ†๏ธ Updates github/codeql-action action to v3
  • โฌ†๏ธ Updates github/super-linter action to v6
  • โฌ†๏ธ Updates husky to v9
  • โฌ†๏ธ Updates lannonbr/issue-label-manager-action action to v4
  • โฌ†๏ธ Updates lint-staged to v15
  • โฌ†๏ธ Updates mkdocs-git-revision-date-localized-plugin to v1
  • โฌ†๏ธ Updates mkdocs-include-markdown-plugin to v6
  • โฌ†๏ธ Updates mkdocs-material to v9
  • โฌ†๏ธ Updates mondeja/remove-labels-gh-action action to v2
  • โฌ†๏ธ Updates node to v22
  • โฌ†๏ธ Updates peaceiris/actions-gh-pages action to v4
  • โฌ†๏ธ Updates peter-evans/create-or-update-comment action to v4
  • โฌ†๏ธ Updates peter-evans/create-pull-request action to v6
  • โฌ†๏ธ Updates pnpm/action-setup action to v4
  • โฌ†๏ธ Updates prettier to v3
  • โฌ†๏ธ Updates pretty-quick to v4
  • โฌ†๏ธ Updates prologic/action-remark-lint action to v5
  • โฌ†๏ธ Updates pymdown-extensions to v10
  • โฌ†๏ธ Updates release-it to v17
  • โฌ†๏ธ Updates remark (major) (remark-cli, remark-lint-code-block-style, remark-lint-ordered-list-marker-value, remark-validate-links)
  • โฌ†๏ธ Updates stefanzweifel/git-auto-commit-action action to v5
  • โฌ†๏ธ Updates stylelint to v16
  • โฌ†๏ธ Updates stylelint-config-standard to v36
  • โฌ†๏ธ Updates stylelint-order to v6
  • โฌ†๏ธ Updates stylelint-scss to v6
  • โฌ†๏ธ Updates technote-space/auto-card-labeler action to v2
  • โฌ†๏ธ Updates textlint to v14
  • โฌ†๏ธ Updates textlint-rule-alex to v5
  • โฌ†๏ธ Updates textlint-rule-stop-words to v5
  • โฌ†๏ธ Updates textlint-rule-terminology to v5
  • โฌ†๏ธ Updates tibdex/backport action to v2
  • โฌ†๏ธ Updates ubuntu to v22
  • โฌ†๏ธ Updates wagoid/commitlint-github-action action to v6
  • โฌ†๏ธ Lock file maintenance
  • ๐Ÿ” Create all rate-limited PRs at once ๐Ÿ”

Edited/Blocked

These updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox.


Warning

Renovate failed to look up the following dependencies: Failed to look up github-tags package iterative/link-check.action.

Files affected: .github/workflows/link-check-all.yml, .github/workflows/link-check-deploy.yml


Detected dependencies

docker-compose
docker-compose.yml
dockerfile
Dockerfile
  • node 12-buster
tilt_modules/restart_process/Dockerfile
github-actions
.github/workflows/action-devto.yml
  • actions/checkout v2
  • ful1e5/TheActionDev v2
.github/workflows/add-labels.yml
.github/workflows/backport.yml
  • tibdex/backport v1
  • ubuntu 18.04
.github/workflows/blogpost-workflow.yml
  • actions/checkout v2
.github/workflows/broken-links.yml
  • actions/checkout v2
  • actions/setup-node v2.1.4
.github/workflows/build.yml
  • actions/checkout v2
  • actions/setup-node v1
  • pnpm/action-setup v1.2.1
.github/workflows/changelog.yml
  • actions/cache v2.1.4
.github/workflows/chart-release.yaml
  • actions/checkout v2
  • azure/setup-helm v1
  • helm/chart-releaser-action v1.1.0
.github/workflows/check-urls.yml
  • actions/checkout v2
  • trilom/file-changes-action v1.2.4
  • actions/upload-artifact v2
.github/workflows/claim.yml
  • actions/github-script v3.1
.github/workflows/cleanup.yml
  • kolpav/purge-artifacts-action v1
.github/workflows/close-pending.yml
.github/workflows/closing.yml
  • peter-evans/create-or-update-comment v1
  • peter-evans/create-or-update-comment v1
  • ubuntu 18.04
.github/workflows/codeql-analysis.yml
  • actions/checkout v2
  • github/codeql-action v1
  • github/codeql-action v1
.github/workflows/codespell.yaml
  • actions/checkout v2
.github/workflows/comment_on_issue.yml
  • actions/github-script v3.1
.github/workflows/comments.yml
.github/workflows/commitlint.yml
  • actions/checkout v2
  • wagoid/commitlint-github-action v2.2.5
.github/workflows/compress.yml
  • actions/checkout v2
  • peter-evans/create-pull-request v3
.github/workflows/docker.yaml
  • actions/checkout v2
  • anchore/scan-action 1.0.6
  • actions/upload-artifact v2
.github/workflows/enforce-labels.yml
  • yogevbd/enforce-label-action 2.2.1
.github/workflows/gh-pages.yml
  • JamesIves/github-pages-deploy-action 4.0.0
.github/workflows/greetings.yml
.github/workflows/helm.yml
  • actions/checkout v2
  • docker/setup-qemu-action v1
  • docker/setup-buildx-action v1
  • docker/login-action v1
  • docker/build-push-action v2
  • stefanprodan/helm-gh-pages v1.3.0
.github/workflows/label.yml
  • actions/labeler v2
.github/workflows/labels.yml
  • lannonbr/issue-label-manager-action 2.0.0
.github/workflows/labels2.yml
  • actions/checkout v2
  • crazy-max/ghaction-github-labeler v3
.github/workflows/link-check-all.yml
  • actions/checkout v2
  • iterative/link-check.action v0.7
.github/workflows/link-check-deploy.yml
  • actions/checkout v2
  • LouisBrunner/checks-action v1.0.0
  • iterative/link-check.action v0.7
  • LouisBrunner/checks-action v1.0.0
  • LouisBrunner/checks-action v1.0.0
.github/workflows/lint-pr.yml
.github/workflows/lint-test.yaml
  • actions/checkout v2
  • azure/setup-helm v1
  • actions/setup-python v2
  • helm/chart-testing-action v2.0.1
  • helm/kind-action v1.1.0
.github/workflows/lint.yml
  • actions/checkout v2
  • actions/setup-python v1
  • ubuntu 20.04
.github/workflows/linter.yml
  • actions/checkout v2
  • github/super-linter v3
.github/workflows/lock.yml
  • dessant/lock-threads v2.0.3
.github/workflows/mkdocs.yml
  • actions/checkout v2
  • actions/setup-python v2
  • actions/cache v2
  • peaceiris/actions-gh-pages v3
  • ubuntu 18.04
.github/workflows/opengraph-card.yml
  • actions/checkout v2
  • stefanzweifel/git-auto-commit-action v4
.github/workflows/pagespeed.yml
  • actions/checkout v2
  • stefanzweifel/git-auto-commit-action v4
.github/workflows/pr-helper.yml
  • Matticusau/pr-helper v1.2.5
.github/workflows/project-card-moved.yml
  • technote-space/auto-card-labeler v1
.github/workflows/release-changelog.yml
.github/workflows/release.yml
  • actions/checkout v2
  • haya14busa/action-bumpr v1
  • haya14busa/action-update-semver v1
  • haya14busa/action-cond v1
  • actions/create-release v1
  • actions/checkout v2
  • haya14busa/action-bumpr v1
.github/workflows/remove-labels.yml
  • mondeja/remove-labels-gh-action v1
  • mondeja/remove-labels-gh-action v1
  • mondeja/remove-labels-gh-action v1
.github/workflows/remove-old-artifacts.yml
  • c-hive/gha-remove-artifacts v1
.github/workflows/repo-traffic.yml
  • actions/checkout v2
  • sangonzal/repository-traffic-action v0.1.4
  • EndBug/add-and-commit v4
.github/workflows/reviewdog.yml
  • actions/checkout v2
  • prologic/action-remark-lint v2
.github/workflows/shiftleft-analysis.yml
  • actions/checkout v1
  • github/codeql-action v1
.github/workflows/spellcheck.yml
.github/workflows/stale.yml
  • actions/stale v3
.github/workflows/sync.yml
  • actions/checkout v2
  • actions/setup-node v2.1.4
  • tretuna/sync-branches 1.2.0
.github/workflows/toc.yml
  • actions/checkout v2
  • stefanzweifel/git-auto-commit-action v4
.github/workflows/unlock-reopened-issues.yml
  • Dunning-Kruger/unlock-issues v1.1
.github/workflows/version-update.yml
  • actions/checkout v2
  • stefanzweifel/git-auto-commit-action v4
.github/workflows/welcome_contributor.yml
  • actions/github-script v3.1
.github/workflows/yaml-lint.yml
  • actions/checkout v2.3.4
  • ibiqlik/action-yamllint v3.0.2
helm-values
charts/values.yaml
npm
package.json
  • alex ^9.1.0
  • conventional-changelog-cli ^2.1.1
  • dockerfile_lint ^0.3.4
  • husky ^7.0.1
  • git-cz ^4.7.6
  • jsonlint ^1.6.3
  • license-checker ^25.0.1
  • lint-staged ^11.0.1
  • markdown-link-check ^3.8.7
  • markdownlint-cli ^0.27.1
  • stylelint ~13.13.1
  • stylelint-config-standard ^22.0.0
  • stylelint-order ^4.1.0
  • stylelint-scss ^3.20.1
  • prettier ^2.3.2
  • pretty-quick ^3.1.1
  • release-it ^14.10.0
  • remark-cli ^9.0.0
  • remark-lint-code-block-style ^2.0.1
  • remark-lint-ordered-list-marker-value ^2.0.1
  • remark-preset-davidtheclark ^0.12.0
  • remark-validate-links ^10.0.4
  • repo-link-check ^0.7.1
  • textlint ^12.0.2
  • textlint-rule-alex ^3.0.0
  • textlint-rule-common-misspellings ^1.0.1
  • textlint-rule-en-capitalization ^2.0.2
  • textlint-rule-stop-words ^2.0.9
  • textlint-rule-terminology ^2.1.5
  • textlint-rule-write-good ^2.0.0
  • validate-commit-msg ^2.14.0
  • yaml-lint ^1.2.4
  • node >= 12.x
tilt_modules/tilt_inspector/package.json
  • @tilt.dev/tilt-inspector 0.1.8
nvm
.nvmrc
  • node 14.16.0
pip_requirements
docs/requirements.txt
  • click-man >=0.4.1
  • mkdocs >=1.2
  • pygments >=2.4
  • mkdocs-material >=7.1.2
  • markdown >=3.2
  • markdown-checklist >=0.4.1
  • fontawesome-markdown >=0.2.6
  • markdown-include >=0.6.0
  • pymdown-extensions >=8.2
  • python-markdown-math >=0.6
  • mkdocs-material-extensions >=1.0
  • mkdocs-git-revision-date-localized-plugin >=0.9.2
  • mkdocs-awesome-pages-plugin >=2.5.0
  • mdx-truly-sane-lists >=1.2
  • mkdocs-include-markdown-plugin >=3.2.1
  • mkdocs-redirects >=1.0.3
  • smarty >=0.3.3
  • dumb-init >=1.2.5
  • cookiecutter >=1.7.3

  • Check this box to trigger a request for Renovate to run again on this repository

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: 788568b6597a7b8fd1d24aee207df9460fba31a9

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: 29fbb923d8b0e43c228272fe473a4f574076d802

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: a2038481c733ecc5f23a278821dc4e3950b74d05

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 788568b6597a7b8fd1d24aee207df9460fba31a9

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • remark-preset-davidtheclark-0.12.0.tgz (Root Library)
    • remark-cli-7.0.1.tgz
      • remark-11.0.2.tgz
        • remark-parse-7.0.2.tgz
          • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1010266 (Medium) detected in lodash-2.4.2.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: cbfc88dbae3efca916b4a507fecb8a7c73d5a440

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2021-33623 (High) detected in trim-newlines-1.0.0.tgz

CVE-2021-33623 - High Severity Vulnerability

Vulnerable Library - trim-newlines-1.0.0.tgz

Trim newlines from the start and/or end of a string

Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-1.0.0.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/get-pkg-repo/node_modules/trim-newlines/package.json,scala-patterns/node_modules/alex/node_modules/trim-newlines/package.json

Dependency Hierarchy:

  • textlint-rule-alex-1.3.1.tgz (Root Library)
    • alex-5.1.0.tgz
      • meow-3.7.0.tgz
        • โŒ trim-newlines-1.0.0.tgz (Vulnerable Library)

Found in HEAD commit: a2038481c733ecc5f23a278821dc4e3950b74d05

Found in base branch: master

Vulnerability Details

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

Publish Date: 2021-05-28

URL: CVE-2021-33623

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623

Release Date: 2021-05-28

Fix Resolution: trim-newlines - 3.0.1, 4.0.1


Step up your Open Source Security Game with WhiteSource here

CVE-2018-3721 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: scala-patterns/package.json

Path to vulnerable library: scala-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 788568b6597a7b8fd1d24aee207df9460fba31a9

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5


Step up your Open Source Security Game with WhiteSource here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.