Skip to content

Update moment.js, sequelize and node-sass-middleware to avoid vulnerabilities #73

@Doddzy

Description

@Doddzy

Moment.js has potential regex dos issues at version 2.11.0, the dependencies relying on this should be updated to avoid it. Line 45 of memberValidator.is currently is using moment on user data and could be an issue, this is only actual use I can see that may be a problem, but please run the tool again and check for more issues.

As created by node security project:

https://nodesecurity.io/advisories/55
project-m@0.0.0 > moment@2.11.0
project-m@0.0.0 > sequelize-cli@2.2.1 > moment@2.11.0
project-m@0.0.0 > sequelize-cli@2.2.1 > umzug@1.7.1 > moment@2.11.0
project-m@0.0.0 > sequelize@3.15.1 > moment@2.11.0
project-m@0.0.0 > sequelize@3.15.1 > moment-timezone@0.4.1 > moment@2.11.0

Node sass middleware should also be updated to avoid potential issue with 'is-my-json-valid'
project-m@0.0.0 > node-sass-middleware@0.8.0 > node-sass@3.4.2…

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions