npm Security Vulnerabilities

[suuuehgi]

For the current image 1.19.0 npm audit lists 38 vulnerabilities (8 low, 15 moderate, 13 high, 2 critical).

$ podman exec systemd-spliit-dev npm audit --omit=dev
[...]
28 vulnerabilities (6 low, 13 moderate, 7 high, 2 critical)

That should be addressed.

[BastiOfBerlin]

I think this is obsolete now?

[suuuehgi]

I think this is obsolete now?

Well ... in the sense that the number significantly decreased:

$ podman exec systemd-spliit npm audit --omit=dev
# npm audit report

deepmerge-ts  <8.0.0
Severity: high
DeepmergeTS has stack exhaustion when merging recursive object graphs - https://github.com/advisories/GHSA-ggr8-5vv4-36mx
fix available via `npm audit fix --force`
Will install prisma@6.12.0, which is a breaking change
node_modules/deepmerge-ts
  @prisma/config  >=6.13.0-dev.1
  Depends on vulnerable versions of deepmerge-ts
  node_modules/@prisma/config
    prisma  6.13.0-dev.1 - 7.10.0-integration-fix-prisma-publish-token.1
    Depends on vulnerable versions of @prisma/config
    node_modules/prisma

uuid  <11.1.1
Severity: moderate
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - https://github.com/advisories/GHSA-w5hq-g745-h8pq
No fix available
node_modules/uuid
  next-s3-upload  *
  Depends on vulnerable versions of uuid
  node_modules/next-s3-upload

5 vulnerabilities (2 moderate, 3 high)

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

P. S. Welcome back and thank you for looking into this! 🙂