From e6cca731385c82380d5ac386815385923ed11804 Mon Sep 17 00:00:00 2001 From: ilammy Date: Thu, 12 Mar 2020 12:54:03 +0200 Subject: [PATCH 1/4] Refresh dependencies "npm audit" started whining about moderate denial of service vulnerability in a dependency of dependency of dependency (eslint > espree > acorn). This is not really serious because we use "eslint" only for development. However, red builds are not good so bump the pinned version in package.lock. (Released versions are not affected because they do not include eslint.) --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 4826a1f..f2c38af 100644 --- a/package-lock.json +++ b/package-lock.json @@ -30,9 +30,9 @@ } }, "acorn": { - "version": "7.1.0", - "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.1.0.tgz", - "integrity": "sha512-kL5CuoXA/dgxlBbVrflsflzQ3PAas7RYZB52NOm/6839iVYJgKMJ3cQJD+t2i5+qFa8h3MDpEOJiS64E8JLnSQ==", + "version": "7.1.1", + "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.1.1.tgz", + "integrity": "sha512-add7dgA5ppRPxCFJoAGfMDi7PIBXq1RtGo7BhbLaxwrXPOmw8gq48Y9ozT01hUKy9byMjlR20EJhu5zlkErEkg==", "dev": true }, "acorn-jsx": { From 075328686be0a89b149ce491c4655b7a0b9c08f5 Mon Sep 17 00:00:00 2001 From: Sean Kelly Date: Thu, 19 Mar 2020 02:24:49 -0400 Subject: [PATCH 2/4] Add VisualStudioVersion variable to exports (#3) This variable seems to be necessary for some build tools like colcon: https://colcon.readthedocs.io/en/released/ --- index.js | 1 + 1 file changed, 1 insertion(+) diff --git a/index.js b/index.js index 9f780d2..9c08809 100644 --- a/index.js +++ b/index.js @@ -14,6 +14,7 @@ const InterestingVariables = [ 'LIBPATH', 'Path', 'Platform', + 'VisualStudioVersion', /^VCTools/, /^VSCMD_/, /^WindowsSDK/i, From 26cb400781a99d2b76a7ec8945b5226c3dbdc170 Mon Sep 17 00:00:00 2001 From: ilammy Date: Thu, 19 Mar 2020 08:34:02 +0200 Subject: [PATCH 3/4] Run "npm audit" for release branch too I'd like to be notified about weird vulnerabilities in JavaScript libraries for the release branch as well. It's double important since the release branch ships particular pinned version of *all* dependencies. --- .github/workflows/release.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3c845ed..a215efc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -23,3 +23,10 @@ jobs: run: | cl.exe hello.c hello.exe + audit: + name: npm audit + runs-on: windows-latest + steps: + - name: Check out source code + uses: actions/checkout@v1 + - run: npm audit From ddf4cb029f4d8fdc36d61065301564a7802bf286 Mon Sep 17 00:00:00 2001 From: ilammy Date: Thu, 19 Mar 2020 08:41:04 +0200 Subject: [PATCH 4/4] Fail audit on moderate and above vulnerabilities MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Set the threshold to "moderate" and above. Currently msvc-dev-cmd has an issue in transitive dev-dependency "minimist" [1] via somewhat long chain of dependencies: - eslint > file-entry-cache > flat-cache > write > mkdirp > minimist - eslint > mkdirp > minimist In order for this to be resolved all these packages need to do something about their pinned versions. I don't want to sit there with a red build because of some possible low-severity prototype pollution in dev dependency. Anything higher -- okay, I'll look at at, and apply a fix if necessary. (Maybe we should not audit dev dependencies at all...) This particular vulnerability can be exploited by an attacker who can submit a pull request and do "something bad"™ to Actions runners executing jobs for this repository. However, since it's a dev dependency, nothing will happen to our users. So we can safely ignore this advisory. [1]: https://npmjs.com/advisories/1179 --- .github/workflows/main.yml | 2 +- .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index f7c19cf..486fded 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -34,4 +34,4 @@ jobs: - name: Check out source code uses: actions/checkout@v1 - run: npm install - - run: npm audit + - run: npm audit --audit-level=moderate diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a215efc..03e739d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -29,4 +29,4 @@ jobs: steps: - name: Check out source code uses: actions/checkout@v1 - - run: npm audit + - run: npm audit --audit-level=moderate