qlik-oss / enigma.js / 30889161431

95%

push

github

fix(security): upgrade vulnerable axios, jsonwebtoken and ws in examples (#1065)

Dependabot flags 40+ high/critical advisories rooted in three severely
outdated packages pinned in the example apps:

- axios ^0.19.2 -> ^1.19.0 (SSRF, prototype pollution, credential/header
  leaks, ReDoS across many advisories, e.g. GHSA-jr5f-v2jv-69x6,
  GHSA-3g43-6gmg-66jw, GHSA-8kw3-6mqm-4hcw)
- jsonwebtoken ^7.4.2 -> ^9.0.3 (insecure key retrieval / algorithm
  confusion, e.g. GHSA-8cf7-32gw-wr33, GHSA-qwph-4952-7xr6)
- ws ^3.1.0 -> ^8.21.2 in examples/package.json (memory-exhaustion and
  header-count DoS, GHSA-96hv-2xvq-fx4p, GHSA-3h5v-q93c-6h6q)

The car-models example's own ws devDependency is removed instead of
bumped since it's never imported there (the browser code uses the
native WebSocket global).

The published library itself ships zero runtime dependencies, so none
of this affects consumers of enigma.js -- only the checked-in example
apps in this repo. Verified example call sites (axios.post, jwt.sign,
`new WebSocket(url, {headers})`) are unaffected by the major version
bumps. Lint and unit tests pass.

372 of 400 branches covered (93.0%)

Branch coverage included in aggregate %.

591 of 616 relevant lines covered (95.94%)

156.5 hits per line