upgrade javascript dependencies with security issues

[pjfanning]

ISSUE TYPE

• Bug Report

Have a look at the vulnerabilities in https://github.com/pjfanning/cloudstack/security/dependabot associated with package-lock.json

[yadvr]

That link gives a 404, maybe it's privately visible only @pjfanning ?

[pjfanning]

@rohityadavcloud these are the dependencies from that github page.

nanoid
Moderate severity


shelljs
High severity


follow-redirects
High severity


json-schema
Moderate severity


ansi-regex
Moderate severity


nth-check
Moderate severity


tmpl
Moderate severity


axios
High severity


ansi-html
High severity


path-parse
Moderate severity


tar
High severity


@npmcli/git
Moderate severity


normalize-url
High severity


color-string
Moderate severity


trim-newlines
High severity


glob-parent
High severity


ws
Moderate severity


dns-packet
High severity


browserslist
Moderate severity


postcss
Moderate severity


hosted-git-info
Moderate severity


ssri
High severity


url-parse
High severity


lodash
High severity


merge
High severity


is-svg
High severity


y18n
High severity


elliptic
Moderate severity


node-notifier
Moderate severity


ini
High severity


highlight.js
Moderate severity


object-path
High severity


node-forge
High severity


node-fetch
High severity


bl
High severity


yargs-parser
Moderate severity


dot-prop
High severity


prismjs
High severity

serialize-javascript
High severity

[pjfanning]

It's easy to get github to run dependabot analyses on your own github fork of apache/cloudstack - there is Security tab (between Wiki and Insights)

[davidjumani]

@pjfanning Let's check back on the dependencies when #5151 is merged as it involves changing the vue library itself which could potentially fix some of the dependency issues

[nvazquez]

PR #5151 got merged today - @davidjumani please advise if this issue is still valid after the vue upgrade

[pjfanning]

Thanks for working on #5151 - it does fix a lot of the dependabot highlighted issues. There are still a number of CVEs present though. One example is GHSA-hgjh-723h-mx2j

Would it be possible to use npm audit fix on the latest code to see if there any low-hanging fruit changes that can be made?

[davidjumani]

Can be fixed by #6091

[nvazquez]

PR #6091 merged, @davidjumani can you please advise if there are more dependencies to update after the PR merged?

[pjfanning]

thanks for looking into this - dependabot is still recommending this - https://github.com/apache/cloudstack/blob/main/ui/package.json#L89 to update to 7.0.0 - due to GHSA-r8f7-9pfq-mjmv

[davidjumani]

@utchoang Can you please check if updating this will cause breaking changes? Thanks