From eda1099b419c633cd78f6fedd8b1d4b62dc2dc25 Mon Sep 17 00:00:00 2001 From: grossmj Date: Fri, 12 Aug 2022 11:51:30 +0200 Subject: [PATCH 1/3] Fix node-fetch and electron CVE issues --- package.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index 3195023c..5ed33834 100644 --- a/package.json +++ b/package.json @@ -76,7 +76,7 @@ "ngx-childprocess": "^0.0.6", "ngx-device-detector": "^3.0.0", "ngx-electron": "^2.2.0", - "node-fetch": "^3.2.4", + "node-fetch": "^3.2.10", "notosans-fontface": "^1.3.0", "postcss-loader": "^6.2.1", "prettier-plugin-organize-imports": "^2.3.4", @@ -105,7 +105,7 @@ "@types/jasminewd2": "^2.0.10", "@types/node": "^17.0.31", "codelyzer": "^0.0.28", - "electron": "13.6.6", + "electron": "20.0.2", "electron-builder": "^23.0.3", "file-loader": "^6.2.0", "jasmine-core": "^4.1.0", From 3cf1984b39c6202a0e725d5208b686c9c80778f4 Mon Sep 17 00:00:00 2001 From: grossmj Date: Fri, 12 Aug 2022 12:51:26 +0200 Subject: [PATCH 2/3] Update yarn.lock --- yarn.lock | 47 ++++++++++++++++++++++++++++++----------------- 1 file changed, 30 insertions(+), 17 deletions(-) diff --git a/yarn.lock b/yarn.lock index 5b80591c..7e83246a 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1231,7 +1231,7 @@ resolved "https://registry.yarnpkg.com/@discoveryjs/json-ext/-/json-ext-0.5.6.tgz#d5e0706cf8c6acd8c6032f8d54070af261bbbb2f" integrity sha512-ws57AidsDvREKrZKYffXddNkyaF14iHNHm8VQnZH6t99E8gczjNN0GpvcGny0imC80yQ0tHz1xVUKk/KFQSUyA== -"@electron/get@^1.0.1", "@electron/get@^1.14.1": +"@electron/get@^1.14.1": version "1.14.1" resolved "https://registry.yarnpkg.com/@electron/get/-/get-1.14.1.tgz#16ba75f02dffb74c23965e72d617adc721d27f40" integrity sha512-BrZYyL/6m0ZXz/lDxy/nlVhQz+WF+iPS6qXolEU8atw7h6v1aYkjwJZ63m+bJMBTxDE66X+r2tPS4a/8C82sZw== @@ -2060,11 +2060,6 @@ resolved "https://registry.yarnpkg.com/@types/node/-/node-17.0.41.tgz#1607b2fd3da014ae5d4d1b31bc792a39348dfb9b" integrity sha512-xA6drNNeqb5YyV5fO3OAEsnXLfO7uF0whiOfPTz5AeDo8KeZFmODKnvwPymMNO8qE/an8pVY/O50tig2SQCrGw== -"@types/node@^14.6.2": - version "14.18.21" - resolved "https://registry.yarnpkg.com/@types/node/-/node-14.18.21.tgz#0155ee46f6be28b2ff0342ca1a9b9fd4468bef41" - integrity sha512-x5W9s+8P4XteaxT/jKF0PSb7XEvo5VmqEWgsMlyeY4ZlLK8I6aH6g5TPPyDlLAep+GYf4kefb7HFyc7PAO3m+Q== - "@types/node@^16.11.26": version "16.11.39" resolved "https://registry.yarnpkg.com/@types/node/-/node-16.11.39.tgz#07223cd2bc332ad9d92135e3a522eebdee3b060e" @@ -2180,6 +2175,13 @@ dependencies: "@types/yargs-parser" "*" +"@types/yauzl@^2.9.1": + version "2.10.0" + resolved "https://registry.yarnpkg.com/@types/yauzl/-/yauzl-2.10.0.tgz#b3248295276cf8c6f153ebe6a9aba0c988cb2599" + integrity sha512-Cn6WYCm0tXv8p6k+A8PvbDG763EDpBoTzHdA+Q/MF6H3sapGjCm9NzoaJncJS9tUKSuCoDs9XHxYYsQDgxR6kw== + dependencies: + "@types/node" "*" + "@webassemblyjs/ast@1.11.1": version "1.11.1" resolved "https://registry.yarnpkg.com/@webassemblyjs/ast/-/ast-1.11.1.tgz#2bfd767eae1a6996f432ff7e8d7fc75679c0b6a7" @@ -4430,14 +4432,14 @@ electron@*: "@types/node" "^16.11.26" extract-zip "^1.0.3" -electron@13.6.6: - version "13.6.6" - resolved "https://registry.yarnpkg.com/electron/-/electron-13.6.6.tgz#ebd4754b2b55d54a2e8e9cdc3d0a2bb6b7053827" - integrity sha512-TP2Bl1nTxaH1yRmlYiF7imzvKE/NASE0cl6wOYA3AaP/UrBGc4L3NwJfn5Z55o+1t4TH8vCRxENufESyb32HhA== +electron@20.0.2: + version "20.0.2" + resolved "https://registry.yarnpkg.com/electron/-/electron-20.0.2.tgz#5a610b07192a03979f83a35b9b9d1568a7f08c93" + integrity sha512-Op4nxSyXH0tXjhvWC+WDn9EI0gep5etPccainxu1A4wes+ZFQBMCBXxibotanJfG+WNW4RaOv88NArwHIsSmPw== dependencies: - "@electron/get" "^1.0.1" - "@types/node" "^14.6.2" - extract-zip "^1.0.3" + "@electron/get" "^1.14.1" + "@types/node" "^16.11.26" + extract-zip "^2.0.1" emoji-regex@^8.0.0: version "8.0.0" @@ -4839,6 +4841,17 @@ extract-zip@^1.0.3: mkdirp "^0.5.4" yauzl "^2.10.0" +extract-zip@^2.0.1: + version "2.0.1" + resolved "https://registry.yarnpkg.com/extract-zip/-/extract-zip-2.0.1.tgz#663dca56fe46df890d5f131ef4a06d22bb8ba13a" + integrity sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg== + dependencies: + debug "^4.1.1" + get-stream "^5.1.0" + yauzl "^2.10.0" + optionalDependencies: + "@types/yauzl" "^2.9.1" + extsprintf@1.3.0: version "1.3.0" resolved "https://registry.yarnpkg.com/extsprintf/-/extsprintf-1.3.0.tgz#96918440e3041a7a414f8c52e3c574eb3c3e1e05" @@ -6838,10 +6851,10 @@ node-fetch@^2.6.7: dependencies: whatwg-url "^5.0.0" -node-fetch@^3.2.4: - version "3.2.5" - resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-3.2.5.tgz#7d31da657804db5185540ddac7ddd516a9a2bd26" - integrity sha512-u7zCHdJp8JXBwF09mMfo2CL6kp37TslDl1KP3hRGTlCInBtag+UO3LGVy+NF0VzvnL3PVMpA2hXh1EtECFnyhQ== +node-fetch@^3.2.10: + version "3.2.10" + resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-3.2.10.tgz#e8347f94b54ae18b57c9c049ef641cef398a85c8" + integrity sha512-MhuzNwdURnZ1Cp4XTazr69K0BTizsBroX7Zx3UgDSVcZYKF/6p0CBe4EUb/hLqmzVhl0UpYfgRljQ4yxE+iCxA== dependencies: data-uri-to-buffer "^4.0.0" fetch-blob "^3.1.4" From 1888174ebf5e8e15c0254b671fef3a5aaa0b0c67 Mon Sep 17 00:00:00 2001 From: grossmj Date: Fri, 12 Aug 2022 17:31:11 +0200 Subject: [PATCH 3/3] Back to electron 13.6.6 --- package.json | 2 +- yarn.lock | 39 +++++++++++++-------------------------- 2 files changed, 14 insertions(+), 27 deletions(-) diff --git a/package.json b/package.json index 5ed33834..5f707704 100644 --- a/package.json +++ b/package.json @@ -105,7 +105,7 @@ "@types/jasminewd2": "^2.0.10", "@types/node": "^17.0.31", "codelyzer": "^0.0.28", - "electron": "20.0.2", + "electron": "13.6.6", "electron-builder": "^23.0.3", "file-loader": "^6.2.0", "jasmine-core": "^4.1.0", diff --git a/yarn.lock b/yarn.lock index 7e83246a..160d4b0e 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1231,7 +1231,7 @@ resolved "https://registry.yarnpkg.com/@discoveryjs/json-ext/-/json-ext-0.5.6.tgz#d5e0706cf8c6acd8c6032f8d54070af261bbbb2f" integrity sha512-ws57AidsDvREKrZKYffXddNkyaF14iHNHm8VQnZH6t99E8gczjNN0GpvcGny0imC80yQ0tHz1xVUKk/KFQSUyA== -"@electron/get@^1.14.1": +"@electron/get@^1.0.1", "@electron/get@^1.14.1": version "1.14.1" resolved "https://registry.yarnpkg.com/@electron/get/-/get-1.14.1.tgz#16ba75f02dffb74c23965e72d617adc721d27f40" integrity sha512-BrZYyL/6m0ZXz/lDxy/nlVhQz+WF+iPS6qXolEU8atw7h6v1aYkjwJZ63m+bJMBTxDE66X+r2tPS4a/8C82sZw== @@ -2060,6 +2060,11 @@ resolved "https://registry.yarnpkg.com/@types/node/-/node-17.0.41.tgz#1607b2fd3da014ae5d4d1b31bc792a39348dfb9b" integrity sha512-xA6drNNeqb5YyV5fO3OAEsnXLfO7uF0whiOfPTz5AeDo8KeZFmODKnvwPymMNO8qE/an8pVY/O50tig2SQCrGw== +"@types/node@^14.6.2": + version "14.18.23" + resolved "https://registry.yarnpkg.com/@types/node/-/node-14.18.23.tgz#70f5f20b0b1b38f696848c1d3647bb95694e615e" + integrity sha512-MhbCWN18R4GhO8ewQWAFK4TGQdBpXWByukz7cWyJmXhvRuCIaM/oWytGPqVmDzgEnnaIc9ss6HbU5mUi+vyZPA== + "@types/node@^16.11.26": version "16.11.39" resolved "https://registry.yarnpkg.com/@types/node/-/node-16.11.39.tgz#07223cd2bc332ad9d92135e3a522eebdee3b060e" @@ -2175,13 +2180,6 @@ dependencies: "@types/yargs-parser" "*" -"@types/yauzl@^2.9.1": - version "2.10.0" - resolved "https://registry.yarnpkg.com/@types/yauzl/-/yauzl-2.10.0.tgz#b3248295276cf8c6f153ebe6a9aba0c988cb2599" - integrity sha512-Cn6WYCm0tXv8p6k+A8PvbDG763EDpBoTzHdA+Q/MF6H3sapGjCm9NzoaJncJS9tUKSuCoDs9XHxYYsQDgxR6kw== - dependencies: - "@types/node" "*" - "@webassemblyjs/ast@1.11.1": version "1.11.1" resolved "https://registry.yarnpkg.com/@webassemblyjs/ast/-/ast-1.11.1.tgz#2bfd767eae1a6996f432ff7e8d7fc75679c0b6a7" @@ -4432,14 +4430,14 @@ electron@*: "@types/node" "^16.11.26" extract-zip "^1.0.3" -electron@20.0.2: - version "20.0.2" - resolved "https://registry.yarnpkg.com/electron/-/electron-20.0.2.tgz#5a610b07192a03979f83a35b9b9d1568a7f08c93" - integrity sha512-Op4nxSyXH0tXjhvWC+WDn9EI0gep5etPccainxu1A4wes+ZFQBMCBXxibotanJfG+WNW4RaOv88NArwHIsSmPw== +electron@13.6.6: + version "13.6.6" + resolved "https://registry.yarnpkg.com/electron/-/electron-13.6.6.tgz#ebd4754b2b55d54a2e8e9cdc3d0a2bb6b7053827" + integrity sha512-TP2Bl1nTxaH1yRmlYiF7imzvKE/NASE0cl6wOYA3AaP/UrBGc4L3NwJfn5Z55o+1t4TH8vCRxENufESyb32HhA== dependencies: - "@electron/get" "^1.14.1" - "@types/node" "^16.11.26" - extract-zip "^2.0.1" + "@electron/get" "^1.0.1" + "@types/node" "^14.6.2" + extract-zip "^1.0.3" emoji-regex@^8.0.0: version "8.0.0" @@ -4841,17 +4839,6 @@ extract-zip@^1.0.3: mkdirp "^0.5.4" yauzl "^2.10.0" -extract-zip@^2.0.1: - version "2.0.1" - resolved "https://registry.yarnpkg.com/extract-zip/-/extract-zip-2.0.1.tgz#663dca56fe46df890d5f131ef4a06d22bb8ba13a" - integrity sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg== - dependencies: - debug "^4.1.1" - get-stream "^5.1.0" - yauzl "^2.10.0" - optionalDependencies: - "@types/yauzl" "^2.9.1" - extsprintf@1.3.0: version "1.3.0" resolved "https://registry.yarnpkg.com/extsprintf/-/extsprintf-1.3.0.tgz#96918440e3041a7a414f8c52e3c574eb3c3e1e05"