Gatsby: [V2] New 'Moderate' vulnerabilities in gatsby dependencies.
I see in issue #5335 package vulnerabilities were addressed, however I see some 'Moderate' ones now so these may be new or only for V2.
version: [email protected]
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby-source-contentful │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gatsby-source-contentful > gatsby-plugin-sharp > │
│ │ imagemin-pngquant > pngquant-bin > bin-build > download > │
│ │ caw > tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby-source-contentful │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gatsby-source-contentful > gatsby-plugin-sharp > │
│ │ imagemin-pngquant > pngquant-bin > bin-wrapper > download > │
│ │ caw > tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby-source-contentful │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gatsby-source-contentful > gatsby-plugin-sharp > │
│ │ imagemin-webp > cwebp-bin > bin-build > download > caw > │
│ │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby-source-contentful │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gatsby-source-contentful > gatsby-plugin-sharp > │
│ │ imagemin-webp > cwebp-bin > bin-wrapper > download > caw > │
│ │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598
mishasaggi
All 19 comments
version: [email protected]
npm: 6.1.0
node: v10.6.0
I am seeing this as well, I thought I'd add to the details.
When I run the command npm list tunnel-agent I get the following:
[email protected] /mnt/d/MyProject ├─┬ [email protected] │ └─┬ [email protected] │ └── [email protected] ├─┬ [email protected] │ └─┬ [email protected] │ ├─┬ [email protected] │ │ └── [email protected] deduped │ └── [email protected] deduped ├─┬ [email protected] │ ├─┬ [email protected] │ │ └─┬ [email protected] │ │ ├─┬ [email protected] │ │ │ └─┬ [email protected] │ │ │ └─┬ [email protected] │ │ │ └── [email protected] deduped │ │ └─┬ [email protected] │ │ └─┬ [email protected] │ │ └─┬ [email protected] │ │ └── [email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └── [email protected] └─┬ [email protected] └─┬ [email protected] └── [email protected] deduped
Seems like a dependency of gatsby-plugin-sharp
sarahannnicholson
on 13 Sep 2018
I attempted to address that in #7740 but I think it needs to be fixed upstream too.
millette
on 13 Sep 2018
I get same issue but with gatsby-plugin-sharp. Seems to be tunnel-agent:
├─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected]
├─┬ [email protected]
│ └─┬ [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected] deduped
│ └── [email protected] deduped
└─┬ [email protected]
├─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected]
└─┬ [email protected]
└─┬ [email protected]
└─┬ [email protected]
└─┬ [email protected]
└─┬ [email protected]
└── [email protected] deduped
Just because of this: https://github.com/kevva/caw/issues/22
ibanlopez
on 23 Oct 2018
Hey. Ive been tracking this tunnel-agent stuff for a minute and its not very hopeful, highly recommend forking CAW and shrink-wrapping, or shrink wrapping tunnel-agent to the latest commit hash.
SalomonSmeke
on 23 Oct 2018
This looks like it can be addressed if gatsby-plugin-sharp uses [email protected] (released about 18 days ago).
It uses new dependencies ([email protected]) wich in turn uses these.
[email protected]
│ │ └─┬ [email protected]
│ │ └─┬ [email protected]
│ │ └── [email protected]
[email protected] no longer has the vulnerability issue.
I'm not sure what it will break but I figured this may help to move this along.
Also, I have a fork setup. But I'm not entirely sure how to test this change...
Any pointers to test this out?
I ran npm run test and npm run test:integration but both showed errors (even without the change from [email protected] to [email protected]).
✖ 255 problems (206 errors, 49 warnings)
206 errors and 0 warnings potentially fixable with the `--fix` option.
$ node --version
v10.13.0
$ npm --version
6.4.1
jfgrissom
on 17 Nov 2018
Interested in how to possibly resolve this issue as well.
=== npm audit security report ===
┌──────────────────────────────────────────────────────────────────────────────┐
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby-plugin-sharp │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gatsby-plugin-sharp > imagemin-mozjpeg > mozjpeg > bin-build │
│ │ > download > caw > tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby-plugin-sharp │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gatsby-plugin-sharp > imagemin-mozjpeg > mozjpeg > │
│ │ bin-wrapper > download > caw > tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby-plugin-sharp │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gatsby-plugin-sharp > imagemin-webp > cwebp-bin > bin-build │
│ │ > download > caw > tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby-plugin-sharp │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gatsby-plugin-sharp > imagemin-webp > cwebp-bin > │
│ │ bin-wrapper > download > caw > tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby-source-contentful │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gatsby-source-contentful > gatsby-plugin-sharp > │
│ │ imagemin-mozjpeg > mozjpeg > bin-build > download > caw > │
│ │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby-source-contentful │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gatsby-source-contentful > gatsby-plugin-sharp > │
│ │ imagemin-mozjpeg > mozjpeg > bin-wrapper > download > caw > │
│ │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby-source-contentful │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gatsby-source-contentful > gatsby-plugin-sharp > │
│ │ imagemin-webp > cwebp-bin > bin-build > download > caw > │
│ │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby-source-contentful │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gatsby-source-contentful > gatsby-plugin-sharp > │
│ │ imagemin-webp > cwebp-bin > bin-wrapper > download > caw > │
│ │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598 │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 8 moderate severity vulnerabilities in 36662 scanned packages
8 vulnerabilities require manual review. See the full report for details.
grantmoran
on 26 Nov 2018
Same issues here. Any word on resolving this issue?
=== npm audit security report ===
┌──────────────────────────────────────────────────────────────────────────────┐
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby-plugin-sharp │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gatsby-plugin-sharp > imagemin-mozjpeg > mozjpeg > bin-build │
│ │ > download > caw > tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby-plugin-sharp │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gatsby-plugin-sharp > imagemin-mozjpeg > mozjpeg > │
│ │ bin-wrapper > download > caw > tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby-plugin-sharp │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gatsby-plugin-sharp > imagemin-webp > cwebp-bin > bin-build │
│ │ > download > caw > tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby-plugin-sharp │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gatsby-plugin-sharp > imagemin-webp > cwebp-bin > │
│ │ bin-wrapper > download > caw > tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598 │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 4 moderate severity vulnerabilities in 30737 scanned packages
daberg2
on 15 Dec 2018
@daberg2 thanks for bringing that to the attention of the team. But as we know this ecosystem is a fast paced, constantly evolving and mutating.
I'm sure that the team is aware of this. And is making plans to update the peer dependencies used by gatsby and the plugins under the care of the team and with that resolve this issue. And if you don't mind being a bit more patient and be on the lookout for feedback on this issue.
jonniebigodes
on 15 Dec 2018
@jonniebigodes thanks for mentioning "patience" to the attention of the users that are following this issue since 13 Aug.
I'm sure we, the users, are being patient (me included). Be sure we don't mind to be on the lookout for feedback on this issue and to be very grateful on the team and everything they are doing with Gatsby, because it's awesome. And if you don't mind we will still be pointing out anything new to the team that we see about this issue just to help. So be patient, because we don't know if the team is whether or not aware about this or if they are making plans to update the peer dependencies used by Gatsby and the plugins.
We just see same issue every time we update and we are just trying to help, but thanks to inform us about the awareness and plans of the team.
ibanlopez
on 15 Dec 2018
Hi @ibanlopez. No need for the toxicity - after all, this is an open source project. Most of us are doing this in our free time. If you feel like this should be fixed: clone the repo, fix it, and submit a PR.
jgierer12
on 15 Dec 2018
@jgierer12 Sorry, I didn't mean to be toxic. Sorry if you haven't understood my point nor have fully read it.
I was trying to point out that it's not about rushing the team on anything, it's just about trying to help. I don't think anyone here is trying to rush anyone to fix anything. So why any contributor should feel rushed to make anybody shut up and be patient?
ibanlopez
on 15 Dec 2018
omg, I'm so sorry @ibanlopez, I interpreted your comment in a passive-aggressive/sarcastic way. (The first sentence in particular, could easily come over as that).
Now that I reread it I can totally see how you meant it. Thanks for clarifying, and sorry again for attacking you so quickly. I hope you don't take it personally :sweat_smile: .
jgierer12
on 15 Dec 2018
@jgierer12 Never mind. I hope I could help to contribute in the project but I'm afraid I don't have the knowledge nor the ability. I'm very thankful for everything all contributors do, it's awesome. I'm sure everybody here are very thankful.
Sorry for the first sentence, I couldn't resist myself after last sentence from jonniebegodes. I just meant that we don't want to rush or piss off anyone, we just try to help the way we can.
ibanlopez
on 15 Dec 2018
i'm refraining from further comments, in order to avoid any more situations like the ones above, i meant what i've said, in the context that i've said it. @ibanlopez sorry if my comment caused any discomfort to you in any way shape or form. But i ask you that in the future be more mindfull of your comments if you don't mind. And i hope you get the chance to further your knowledges and abilities so that sometime in the near future i and other people in here see some contents, plugins, pull requests coming from you. Thanks
jonniebigodes
on 16 Dec 2018
Per @jfgrissom's comment https://github.com/gatsbyjs/gatsby/issues/7293#issuecomment-439585632 it looks like we just need to upgrade some of gatsby-plugin-sharp's dependencies.
Could someone try that and see if all tests keep passing? It might not even be a breaking change from our perspective.
KyleAMathews
on 17 Dec 2018
I looked at a few of the major version changes for imagemin-mozjpeg and it seems most are just for moving the minimum version from node 4 to 6.
KyleAMathews
on 17 Dec 2018
The root of this issue is the usage of the tunnel-agent dependency.
~Tunnel-agent contains the vulnerability in all its recent releases. The latest commit no longer has it, but the maintainer of tunnel-agent didn’t npm publish. Thus the issue persists.~ The maintainer of tunnel-agent has just replied saying that there is no unpublished code, its possible the audit is drunk or that the issue persists on current tunnel-agent.
In the CAW repository I have made a PR which replaces tunnel-agent with what seems to be the original implementation. Node-tunnel.
One possible solution for this repository is to fork my fork of CAW and use that repository as the source of the CAW dependency in a npm shrinkwrap.
Another is for the CAW maintainer to merge my PR.
~Yet another is to point all tunnel-agent dependencies in a shrinkwrap to the latest commit hash from the tunnel-agent repository.~ see above ** wrapped section
Please let me know if I can help in any way, I check my notifications daily.
Cheers,
Salomon
Update: sorry I’m not linking but im on mobile. This should help interested parties click through to the CAW issue and related tunnel-agent discussion.
https://github.com/kevva/caw/pull/23
Note that my PR has been open for 3 months. I wouldn’t count on a merge any time soon.
SalomonSmeke
on 17 Dec 2018
This is now resolved in [email protected]
sidharthachatterjee
on 21 Dec 2018
I can confirm that this issue is resolved now in my setup with [email protected]. Thank you for the fix!
daberg2
on 23 Dec 2018
Related issues
hobochild
·
3Comments
andykais
·
3Comments
totsteps
·
3Comments
Oppenheimer1
·
3Comments
brandonmp
·
3Comments
Most helpful comment
Interested in how to possibly resolve this issue as well.