first commit
This commit is contained in:
cieanyau committed
commit
db5762abd4
687 files changed
+171307
No files matched your search
@@ -0,0 +1,246 @@
|
||||
{
|
||||
"checkedOn": "2026-11-05",
|
||||
"command": "npm audit --json",
|
||||
"exitCode": 1,
|
||||
"interpretation": "12 dependency findings: 6 low, 6 moderate; no high/critical. Primarily propagated through Nuxt/Nitro build tooling. Not a zero-vulnerability claim; production reachability has not been exhaustively determined.",
|
||||
"decision": "Retain current pinned Nuxt and lockfile. Do not apply the suggested force downgrade to Nuxt 4.1.3 without compatibility and security review. Reassess before external release.",
|
||||
"auditReportVersion": 2,
|
||||
"vulnerabilities": {
|
||||
"@nuxt/nitro-server": {
|
||||
"name": "@nuxt/nitro-server",
|
||||
"severity": "low",
|
||||
"isDirect": false,
|
||||
"via": ["nitropack", "nuxt"],
|
||||
"effects": ["nuxt"],
|
||||
"range": ">=3.20.0",
|
||||
"nodes": ["node_modules/@nuxt/nitro-server"],
|
||||
"fixAvailable": {
|
||||
"name": "nuxt",
|
||||
"version": "4.1.3",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"@nuxt/vite-builder": {
|
||||
"name": "@nuxt/vite-builder",
|
||||
"severity": "low",
|
||||
"isDirect": false,
|
||||
"via": ["nuxt"],
|
||||
"effects": ["nuxt"],
|
||||
"range": "3.20.0 - 3.21.11 || >=4.2.0",
|
||||
"nodes": ["node_modules/@nuxt/vite-builder"],
|
||||
"fixAvailable": {
|
||||
"name": "nuxt",
|
||||
"version": "4.1.3",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"@nuxt/vite-server": {
|
||||
"name": "@nuxt/vite-server",
|
||||
"severity": "low",
|
||||
"isDirect": false,
|
||||
"via": ["nuxt"],
|
||||
"effects": ["nuxt"],
|
||||
"range": ">=4.6.0",
|
||||
"nodes": ["node_modules/@nuxt/vite-server"],
|
||||
"fixAvailable": {
|
||||
"name": "nuxt",
|
||||
"version": "4.1.3",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"@rollup/plugin-node-resolve": {
|
||||
"name": "@rollup/plugin-node-resolve",
|
||||
"severity": "low",
|
||||
"isDirect": false,
|
||||
"via": ["deepmerge"],
|
||||
"effects": ["nitropack"],
|
||||
"range": ">=8.0.0",
|
||||
"nodes": ["node_modules/@rollup/plugin-node-resolve"],
|
||||
"fixAvailable": {
|
||||
"name": "nuxt",
|
||||
"version": "4.1.3",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"@vercel/nft": {
|
||||
"name": "@vercel/nft",
|
||||
"severity": "moderate",
|
||||
"isDirect": false,
|
||||
"via": ["glob"],
|
||||
"effects": ["nitropack"],
|
||||
"range": ">=0.29.2",
|
||||
"nodes": ["node_modules/@vercel/nft"],
|
||||
"fixAvailable": {
|
||||
"name": "nuxt",
|
||||
"version": "4.1.3",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"archiver": {
|
||||
"name": "archiver",
|
||||
"severity": "moderate",
|
||||
"isDirect": false,
|
||||
"via": ["readdir-glob"],
|
||||
"effects": ["nitropack"],
|
||||
"range": ">=8.0.0",
|
||||
"nodes": ["node_modules/archiver"],
|
||||
"fixAvailable": {
|
||||
"name": "nuxt",
|
||||
"version": "4.1.3",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"deepmerge": {
|
||||
"name": "deepmerge",
|
||||
"severity": "low",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
{
|
||||
"source": 1243505,
|
||||
"name": "deepmerge",
|
||||
"dependency": "deepmerge",
|
||||
"title": "deepmerge mergeObject() allows prototype poisoning of returned objects",
|
||||
"url": "https://github.com/advisories/GHSA-gcqx-w48m-w2h4",
|
||||
"severity": "low",
|
||||
"cwe": ["CWE-1321"],
|
||||
"cvss": {
|
||||
"score": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
|
||||
},
|
||||
"range": ">=4.2.0 <=4.3.1"
|
||||
}
|
||||
],
|
||||
"effects": ["@rollup/plugin-node-resolve"],
|
||||
"range": ">=4.2.0",
|
||||
"nodes": ["node_modules/deepmerge"],
|
||||
"fixAvailable": {
|
||||
"name": "nuxt",
|
||||
"version": "4.1.3",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"glob": {
|
||||
"name": "glob",
|
||||
"severity": "moderate",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
{
|
||||
"source": 1244013,
|
||||
"name": "glob",
|
||||
"dependency": "glob",
|
||||
"title": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal",
|
||||
"url": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4",
|
||||
"severity": "moderate",
|
||||
"cwe": ["CWE-400"],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": ">=9.0.0 <=14.0.1"
|
||||
},
|
||||
"minimatch"
|
||||
],
|
||||
"effects": ["@vercel/nft"],
|
||||
"range": "9.0.0 - 14.0.1",
|
||||
"nodes": ["node_modules/glob"],
|
||||
"fixAvailable": {
|
||||
"name": "nuxt",
|
||||
"version": "4.1.3",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"minimatch": {
|
||||
"name": "minimatch",
|
||||
"severity": "moderate",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
{
|
||||
"source": 1244623,
|
||||
"name": "minimatch",
|
||||
"dependency": "minimatch",
|
||||
"title": "minimatch has potential denial of service via globparts amplification",
|
||||
"url": "https://github.com/advisories/GHSA-g3hv-75wg-m249",
|
||||
"severity": "moderate",
|
||||
"cwe": ["CWE-405"],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": ">=7.0.0 <11.0.1"
|
||||
}
|
||||
],
|
||||
"effects": ["glob", "readdir-glob"],
|
||||
"range": "7.0.0 - 11.0.0",
|
||||
"nodes": ["node_modules/minimatch"],
|
||||
"fixAvailable": {
|
||||
"name": "nuxt",
|
||||
"version": "4.1.3",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"nitropack": {
|
||||
"name": "nitropack",
|
||||
"severity": "moderate",
|
||||
"isDirect": false,
|
||||
"via": ["@rollup/plugin-node-resolve", "@vercel/nft", "archiver"],
|
||||
"effects": ["@nuxt/nitro-server"],
|
||||
"range": ">=0.1.0",
|
||||
"nodes": ["node_modules/nitropack"],
|
||||
"fixAvailable": {
|
||||
"name": "nuxt",
|
||||
"version": "4.1.3",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"nuxt": {
|
||||
"name": "nuxt",
|
||||
"severity": "low",
|
||||
"isDirect": true,
|
||||
"via": ["@nuxt/nitro-server", "@nuxt/vite-builder", "@nuxt/vite-server"],
|
||||
"effects": [
|
||||
"@nuxt/nitro-server",
|
||||
"@nuxt/vite-builder",
|
||||
"@nuxt/vite-server"
|
||||
],
|
||||
"range": "3.20.0 - 3.21.11 || >=4.2.0",
|
||||
"nodes": ["node_modules/nuxt"],
|
||||
"fixAvailable": {
|
||||
"name": "nuxt",
|
||||
"version": "4.1.3",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"readdir-glob": {
|
||||
"name": "readdir-glob",
|
||||
"severity": "moderate",
|
||||
"isDirect": false,
|
||||
"via": ["minimatch"],
|
||||
"effects": ["archiver"],
|
||||
"range": ">=2.0.0",
|
||||
"nodes": ["node_modules/readdir-glob"],
|
||||
"fixAvailable": {
|
||||
"name": "nuxt",
|
||||
"version": "4.1.3",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"vulnerabilities": {
|
||||
"info": 0,
|
||||
"low": 6,
|
||||
"moderate": 6,
|
||||
"high": 0,
|
||||
"critical": 0,
|
||||
"total": 12
|
||||
},
|
||||
"dependencies": {
|
||||
"prod": 571,
|
||||
"dev": 3,
|
||||
"optional": 79,
|
||||
"peer": 0,
|
||||
"peerOptional": 0,
|
||||
"total": 652
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user