diff --git a/package.json b/package.json index 4f6a71f4b7..70bf9325cf 100644 --- a/package.json +++ b/package.json @@ -72,7 +72,6 @@ "@uppy/file-input": "^2.0.5", "@uppy/progress-bar": "^2.0.4", "@uppy/xhr-upload": "^2.0.7", - "angular": "^1.8.3", "applicationinsights": "^2.3.5", "autobind-decorator": "^2.4.0", "axios": "^0.28.0", @@ -207,7 +206,11 @@ "pac-resolver": "^7.0.1", "socks": "^2.7.4", "jest-environment-jsdom": "29.7.0", - "socket.io": "^4.6.2" + "socket.io": "^4.6.2", + "ws": "^8.18.0", + "semver": "^7.5.4", + "send": "0.19.0", + "serve-static": "1.16.2" }, "packageManager": "yarn@3.8.5" } diff --git a/yarn-audit-known-issues b/yarn-audit-known-issues index 95ed3de32f..b9577e41fd 100644 --- a/yarn-audit-known-issues +++ b/yarn-audit-known-issues @@ -1 +1 @@ -{"actions":[],"advisories":{"1089210":{"findings":[{"version":"1.8.3","paths":["angular"]}],"metadata":null,"vulnerable_versions":">=1.7.0","module_name":"angular","severity":"moderate","github_advisory_id":"GHSA-m2h2-264f-f486","cves":["CVE-2022-25844"],"access":"public","patched_versions":"<0.0.0","cvss":{"score":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"updated":"2023-01-30T05:00:29.000Z","recommendation":"None","cwe":["CWE-770","CWE-1333"],"found_by":null,"deleted":null,"id":1089210,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2022-25844\n- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2772736\n- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2772738\n- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2772737\n- https://snyk.io/vuln/SNYK-JS-ANGULAR-2772735\n- https://stackblitz.com/edit/angularjs-material-blank-zvtdvb\n- https://security.netapp.com/advisory/ntap-20220629-0009/\n- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WUSPYOTOMAZPDEFPWPSCSPMNODRDKK3/\n- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LNAKCNTVBIHWAUT3FKWV5N67PQXSZOO/\n- https://github.com/advisories/GHSA-m2h2-264f-f486","created":"2022-05-03T00:00:44.000Z","reported_by":null,"title":"angular vulnerable to regular expression denial of service (ReDoS)","npm_advisory_id":null,"overview":"AngularJS lets users write client-side web applications. The package angular after 1.7.0 is vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value.\n\n**Note:**\n1. This package has been deprecated and is no longer maintained.\n2. The vulnerable versions are 1.7.0 and higher.","url":"https://github.com/advisories/GHSA-m2h2-264f-f486"},"1093574":{"findings":[{"version":"1.8.3","paths":["angular"]}],"metadata":null,"vulnerable_versions":"<=1.8.3","module_name":"angular","severity":"moderate","github_advisory_id":"GHSA-prc3-vjfx-vhm9","cves":["CVE-2022-25869"],"access":"public","patched_versions":"<0.0.0","cvss":{"score":6.1,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"updated":"2023-09-08T21:19:39.000Z","recommendation":"None","cwe":["CWE-79"],"found_by":null,"deleted":null,"id":1093574,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2022-25869\n- https://glitch.com/edit/%23%21/angular-repro-textarea-xss\n- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783\n- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784\n- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782\n- https://snyk.io/vuln/SNYK-JS-ANGULAR-2949781\n- https://github.com/advisories/GHSA-prc3-vjfx-vhm9","created":"2022-07-16T00:00:20.000Z","reported_by":null,"title":"Angular (deprecated package) Cross-site Scripting","npm_advisory_id":null,"overview":"All versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of `