Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Request for dependency updates to address critical / major vulnerabilities

未关闭
  • 哪里不对？
#5,846 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
35/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
冷清
技术栈
angular, javascript
领域
frontend, security

调研方向

首先运行 npm audit --production，并跟踪 speech-sdk、swiper 和 request 的报告路径。查看链接的 Adaptive Cards issue 以及所述的 Angular 和 request 阻塞项；当存在漏洞的依赖项已更新，或剩余无法修复的阻塞项已明确记录时，即表示完成。

由索引模型根据 Issue 内容生成。

描述

Bot Services bug customer-reported
Is it an issue related to Adaptive Cards?

No response

Is this an accessibility issue?

No response

What version of Web Chat are you using?

Latest production

Which distribution are you using Web Chat from?

NPM

Which hosting environment does this issue primarily affect?

Web apps

Which browsers and platforms do the issue happened?

No response

Which area does this issue affect?

Others or unrelated

Which theme pack does this issue affect?

I did not test it on other theme packs

What is the public URL for the website?

http://virtualagent.hpcloud.hp.com/

Please describe the bug

Critical Issues

  1. [email protected] - Prototype Pollution Currently pinned for adaptivecards compatibility. Versions 6.5.1-12.1.1 are vulnerable, fix is 12.2.0. Advisory: GHSA-hmx5-qpq5-p643
  2. form-data < 2.5.4 - Unsafe Random + CRLF Injection Comes from deprecated request package. No fix available since request is unmaintained. Advisories: GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx
  3. @angular/common ⇐ 19.2.15 - XSRF Token Leak Transitive dependency from [email protected]. Fix available in 19.2.16+. Advisory: GHSA-58c5-g7wp-6w37
  4. @angular/core ⇐ 18.2.14 - XSS Issues Also from [email protected]. Multiple XSS vulnerabilities in i18n and SVG handling. Advisories: GHSA-prjf-86w9-mfqv, GHSA-g93w-mfhg-p222, GHSA-jrmj-c5cx-3cw6

High Severity Issues :

(same speech-sdk blocker as above):
5. @angular/common: GHSA-p3vc-36g9-x9gr (DoS via OOM), GHSA-q6f4-qqrg-jv6x (Info Leak), GHSA-48r7-hpm6-gfxm (DoS)
6. @angular/core: GHSA-rgjc-h3x7-9mwg (DOM Clobbering), GHSA-692r-grfm-v8x7 (Template XSS)

What's Blocking Fixes

  • Speech SDK 1.17.0 pulls in old Angular versions
  • Adaptive Cards needs swiper v8 specifically
  • The request package is deprecated with no replacement

What Would Help
If you could update:

  1. Speech SDK to use fixed Angular versions
  2. Adaptive Cards to work with swiper 12+ (logged separately https://github.com/microsoft/AdaptiveCards/issues/9381)
  3. Replace request with a maintained HTTP client
Do you see any errors in console log?
How to reproduce the issue?

n/a

What do you expect?

If you could update:

  1. Speech SDK to use fixed Angular versions
  2. Adaptive Cards to work with swiper 12+ (NOTE: this will be logged as an issue in the AdaptiveCard repo)
  3. Replace request with a maintained HTTP client
What actually happened?

n/a

Do you have any screenshots or recordings to repro the issue?

n/a

Adaptive Card JSON
Additional context

Vulnerabilities discovered via npm audit --production

主要语言
HTML
星标
1.8k
派生
1.6k
平均合并
17 小时 7 分钟
30 天内合并 PR
67

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

microsoft/BotFramework-WebChat 的其他 Issue

查看 microsoft/BotFramework-WebChat 的全部 Issue

相似的 Issue

更多 Web Dev Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。