vulnerability with deepmerge in shepherd.js
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 68/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- angular, typescript
Research direction
Start by tracing the angular-shepherd > shepherd.js > deepmerge-ts dependency path in the project manifests and lockfile. Confirm that the resolved deepmerge-ts version is at least 8.0.0, then run the existing build or test checks; done means the vulnerable dependency path is no longer present.
Written by the indexing model from the issue text.
Description
Hi,
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high │ DeepmergeTS has stack exhaustion when merging recursive │
│ │ object graphs │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ deepmerge-ts │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=8.0.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ angular-shepherd │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ angular-shepherd > shepherd.js > deepmerge-ts │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://www.npmjs.com/advisories/1145093 │
└───────────────┴──────────────────────────────────────────────────────────────┘
Just had this one in the building dependancies
- Dominant language
- TypeScript
- Stars
- 238
- Forks
- 50
- Avg merge
- 1m
- Merged PRs (30d)
- 9
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from shipshapecode/angular-shepherd
-
Difficulty 2/5 1-3 hours Newbie friendliness 48/100
shipshapecode/angular-shepherd#2986 · 3 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
shipshapecode/angular-shepherd#2774 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
shipshapecode/angular-shepherd#2610 · 15 comments · 12 reactions ·
-
angular-shepherd Openenhancement
Difficulty 3/5 1-2 days Newbie friendliness 32/100
shipshapecode/angular-shepherd#2240 · 3 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
shipshapecode/angular-shepherd#1469 · 4 comments · 1 reaction ·
All issues in shipshapecode/angular-shepherd
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#610 ·
-
bug clawsweeper:linked-pr-open clawsweeper:needs-live-repro clawsweeper:no-new-fix-pr impact:message-loss issue-rating: 🐚 platinum hermit P2 regression
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
danielmiessler/LifeOS#2218 ·