XeroAPI/xero-node

Looping between versions due to vulnerabilities

allanquartz opened this issue · 2 comments

allanquartz commented

SDK you're using (please complete the following information):

  • Version [e.g. 3.x.x]
  • latest

Describe the bug
A clear and concise description of what the bug is.
audit keeps looping between versions to fix vulnerabilites

To Reproduce
Steps to reproduce the behavior:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error
    install latest and then try to force audit fixes
    Expected behavior
    A clear and concise description of what you expected to happen.
    Vulnerabilites get fixed
    Screenshots
    If applicable, add screenshots to help explain your problem.

See npm help init for definitive documentation on these fields
and exactly what they do.

Use npm install <pkg> afterwards to install a package and
save it as a dependency in the package.json file.

package name: (xero) xero
version: (1.0.0)
description:
entry point: (index.js)
test command:
git repository:
keywords:
author:
license: (ISC)
About to write to C:\Xero\package.json:

{
"dependencies": {
"xero-node": "^4.33.0"
},
"name": "xero",
"version": "1.0.0",
"main": "index.js",
"devDependencies": {},
"scripts": {
"test": "echo "Error: no test specified" && exit 1"
},
"author": "",
"license": "ISC",
"description": ""
}

Is this OK? (yes)

C:\Xero>npm install xero-node

up to date, audited 90 packages in 1s

13 packages are looking for funding
run npm fund for details

2 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
npm audit fix --force

Run npm audit for details.

C:\Xero>npm audit fix --force
npm WARN using --force Recommended protections disabled.
npm WARN audit Updating xero-node to 3.1.2, which is a SemVer major change.
npm WARN deprecated highlight.js@9.18.5: Support has ended for 9.x series. Upgrade to @latest

added 41 packages, removed 86 packages, changed 1 package, and audited 45 packages in 47s

5 packages are looking for funding
run npm fund for details

npm audit report

highlight.js 9.0.0 - 10.4.0
Severity: moderate
ReDOS vulnerabities: multiple grammars - GHSA-7wwv-vh3v-89cq
fix available via npm audit fix --force
Will install xero-node@4.33.0, which is a breaking change
node_modules/highlight.js
typedoc <=0.21.9 || 0.22.0-beta.0 - 0.22.10 || >=1.0.0-dev.1
Depends on vulnerable versions of highlight.js
Depends on vulnerable versions of marked
node_modules/typedoc
xero-node 3.1.1 - 3.1.2
Depends on vulnerable versions of typedoc
node_modules/xero-node

marked <=4.0.9
Severity: high
Inefficient Regular Expression Complexity in marked - GHSA-5v2h-r2cx-5xgj
Inefficient Regular Expression Complexity in marked - GHSA-rrrm-qjm4-v8hf
fix available via npm audit fix --force
Will install xero-node@4.33.0, which is a breaking change
node_modules/marked

4 vulnerabilities (2 moderate, 2 high)

To address all issues (including breaking changes), run:
npm audit fix --force

C:\Xero>npm audit fix --force
npm WARN using --force Recommended protections disabled.
npm WARN audit Updating xero-node to 4.33.0, which is a SemVer major change.
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see request/request#3142

added 86 packages, removed 41 packages, changed 1 package, and audited 90 packages in 28s

13 packages are looking for funding
run npm fund for details

npm audit report

request *
Severity: moderate
Server-Side Request Forgery in Request - GHSA-p8p7-x288-28g6
fix available via npm audit fix --force
Will install xero-node@3.1.2, which is a breaking change
node_modules/request
xero-node >=4.0.0-alpha.1
Depends on vulnerable versions of request
node_modules/xero-node

2 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
npm audit fix --force

C:\Xero>npm audit fix --force
npm WARN using --force Recommended protections disabled.
npm WARN audit Updating xero-node to 3.1.2, which is a SemVer major change.
npm WARN deprecated highlight.js@9.18.5: Support has ended for 9.x series. Upgrade to @latest

added 41 packages, removed 86 packages, changed 1 package, and audited 45 packages in 31s

5 packages are looking for funding
run npm fund for details

npm audit report

highlight.js 9.0.0 - 10.4.0
Severity: moderate
ReDOS vulnerabities: multiple grammars - GHSA-7wwv-vh3v-89cq
fix available via npm audit fix --force
Will install xero-node@4.33.0, which is a breaking change
node_modules/highlight.js
typedoc <=0.21.9 || 0.22.0-beta.0 - 0.22.10 || >=1.0.0-dev.1
Depends on vulnerable versions of highlight.js
Depends on vulnerable versions of marked
node_modules/typedoc
xero-node 3.1.1 - 3.1.2
Depends on vulnerable versions of typedoc
node_modules/xero-node

marked <=4.0.9
Severity: high
Inefficient Regular Expression Complexity in marked - GHSA-5v2h-r2cx-5xgj
Inefficient Regular Expression Complexity in marked - GHSA-rrrm-qjm4-v8hf
fix available via npm audit fix --force
Will install xero-node@4.33.0, which is a breaking change
node_modules/marked

4 vulnerabilities (2 moderate, 2 high)

To address all issues (including breaking changes), run:
npm audit fix --force

C:\Xero>npm audit fix --force
npm WARN using --force Recommended protections disabled.
npm WARN audit Updating xero-node to 4.33.0, which is a SemVer major change.
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see request/request#3142

added 86 packages, removed 41 packages, changed 1 package, and audited 90 packages in 43s

13 packages are looking for funding
run npm fund for details

npm audit report

request *
Severity: moderate
Server-Side Request Forgery in Request - GHSA-p8p7-x288-28g6
fix available via npm audit fix --force
Will install xero-node@3.1.2, which is a breaking change
node_modules/request
xero-node >=4.0.0-alpha.1
Depends on vulnerable versions of request
node_modules/xero-node

2 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
npm audit fix --force

C:\Xero>npm audit fix --force
npm WARN using --force Recommended protections disabled.
npm WARN audit Updating xero-node to 3.1.2, which is a SemVer major change.
npm WARN deprecated highlight.js@9.18.5: Support has ended for 9.x series. Upgrade to @latest

added 41 packages, removed 86 packages, changed 1 package, and audited 45 packages in 1m

5 packages are looking for funding
run npm fund for details

npm audit report

highlight.js 9.0.0 - 10.4.0
Severity: moderate
ReDOS vulnerabities: multiple grammars - GHSA-7wwv-vh3v-89cq
fix available via npm audit fix --force
Will install xero-node@4.33.0, which is a breaking change
node_modules/highlight.js
typedoc <=0.21.9 || 0.22.0-beta.0 - 0.22.10 || >=1.0.0-dev.1
Depends on vulnerable versions of highlight.js
Depends on vulnerable versions of marked
node_modules/typedoc
xero-node 3.1.1 - 3.1.2
Depends on vulnerable versions of typedoc
node_modules/xero-node

marked <=4.0.9
Severity: high
Inefficient Regular Expression Complexity in marked - GHSA-5v2h-r2cx-5xgj
Inefficient Regular Expression Complexity in marked - GHSA-rrrm-qjm4-v8hf
fix available via npm audit fix --force
Will install xero-node@4.33.0, which is a breaking change
node_modules/marked

4 vulnerabilities (2 moderate, 2 high)

To address all issues (including breaking changes), run:
npm audit fix --force

C:\Xero>npm audit fix --force
npm WARN using --force Recommended protections disabled.
npm WARN audit Updating xero-node to 4.33.0, which is a SemVer major change.
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see request/request#3142

added 86 packages, removed 41 packages, changed 1 package, and audited 90 packages in 42s

13 packages are looking for funding
run npm fund for details

npm audit report

request *
Severity: moderate
Server-Side Request Forgery in Request - GHSA-p8p7-x288-28g6
fix available via npm audit fix --force
Will install xero-node@3.1.2, which is a breaking change
node_modules/request
xero-node >=4.0.0-alpha.1
Depends on vulnerable versions of request
node_modules/xero-node

2 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
npm audit fix --force

C:\Xero>npm uninstall xero-node

removed 89 packages, and audited 1 package in 2s

found 0 vulnerabilities

C:\Xero>npm install xero-node@latest
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see request/request#3142

added 89 packages, and audited 90 packages in 19s

13 packages are looking for funding
run npm fund for details

2 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
npm audit fix --force

Run npm audit for details.

C:\Xero>npm audit

npm audit report

request *
Severity: moderate
Server-Side Request Forgery in Request - GHSA-p8p7-x288-28g6
fix available via npm audit fix --force
Will install xero-node@3.1.2, which is a breaking change
node_modules/request
xero-node >=4.0.0-alpha.1
Depends on vulnerable versions of request
node_modules/xero-node

2 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
npm audit fix --force

C:\Xero>

Additional context
Add any other context about the problem here.
I installed package before doing an init,

sangeet-joy-tw commented

We have updated the required packages in our new version. npm audit report should be clean now.

Please use version v5.0.1

let us know with any further issues on this ticket. @allanquartz

sangeet-joy-tw commented

Please use version v5.0.1