Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(#2368): centralsettlement-failing-GP-tests-with-event-sdk-sidecar #368

Conversation

mdebarros
Copy link
Member

  • Bump to patch version
  • Fixed event-sdk audit events for GET API requests to log the header and URI instead of the payload (which doesn't exist)
  • Updated dependencies
  • Fixed audit-resolve issues with minor to medium issues - however they mostly impact the dev documentation framework with minimal risk

- Bump to patch version
- Fixed event-sdk audit events for GET API requests to log the header and URI instead of the payload (which doesn't exist)
- Updated dependencies
- Fixed audit-resolve issues with minor to medium issues - however they mostly impact the dev documentation framework with minimal risk
@mdebarros mdebarros marked this pull request as ready for review August 4, 2021 12:58
@mdebarros
Copy link
Member Author

mdebarros commented Aug 4, 2021

Audit issues that have been ignored:

  1. yargs-parser
--------------------------------------------------
yargs-parser needs your attention.
[ low ] Prototype Pollution
 vulnerable versions <13.1.2 || >=14.0.0 <15.0.1 || >=16.0.0 <18.1.2 found in:
 - dependencies: @mojaloop/central-ledger>@mojaloop/central-services-shared>widdershins>yargs>yargs-parser
 - dependencies: @mojaloop/central-services-shared>widdershins>yargs>yargs-parser

Risk: Minimal
Impact: Only impacts the /documents end-point.

  1. sanitize-html
--------------------------------------------------
sanitize-html needs your attention.
[ moderate ] Improper Input Validation
 vulnerable versions <2.3.1 found in:
 - dependencies: @mojaloop/central-ledger>@mojaloop/central-services-shared>shins>sanitize-html
 - dependencies: @mojaloop/central-services-shared>shins>sanitize-html
[ moderate ] Improper Input Validation
 vulnerable versions <2.3.2 found in:
 - dependencies: @mojaloop/central-ledger>@mojaloop/central-services-shared>shins>sanitize-html
 - dependencies: @mojaloop/central-services-shared>shins>sanitize-html

Risk: Minimal
Impact: Only impacts the /documents end-point.

  1. glob-parent
--------------------------------------------------
 glob-parent needs your attention.

[ moderate ] Regular expression denial of service
 vulnerable versions <5.1.2 found in:
 - dependencies: @mojaloop/central-ledger>require-glob>glob-parent

Risk: Minimal
Impact: Only impacts the loading of routes/configs on service startup/bootstrap.

  1. hosted-git-info
--------------------------------------------------
 hosted-git-info needs your attention.

[ moderate ] Regular Expression Denial of Service
 vulnerable versions <2.8.9 || >=3.0.0 <3.0.8 found in:
 - dependencies: @mojaloop/central-ledger>npm-run-all>read-pkg>normalize-package-data>hosted-git-info

Risk: Minimal
Impact: Only impacts NPM scripts.

@mdebarros mdebarros merged commit 29fd605 into mojaloop:master Aug 4, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants