License: MIT License
I am Martial Le TOULLEC, people call me Koromerzhin,
| projet | description | Continuous Integration |
|---|---|---|
| docker | docker |  |
| js-commands | js-commands |  |
| labstag | labstag |  |
| lampy | lampy |  |
| repocheck | repocheck |  |
| streamchat | streamchat |  |
| userscripts | userscripts |  |
| webcrawler | webcrawler |  |
| webserver | webserver |  |
No activity tracked![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "dependabot[bot]")
![mend-bolt-for-github[bot] avatar](https://avatars.githubusercontent.com/in/16809?v=4 "mend-bolt-for-github[bot]")
![renovate[bot] avatar](https://avatars.githubusercontent.com/in/2740?v=4 "renovate[bot]")
Please install our new product, Sonatype Lift with advanced features
Vulnerabilities
DepShield reports that this application's usage of pug-code-gen:3.0.2 results in the following vulnerability(s):
Occurrences
pug-code-gen:3.0.2 is a transitive dependency introduced by the following direct dependency(s):
• koromerzhin-dependencies:1.3.4
└─ jscpd:3.5.1
└─ @jscpd/finder:3.5.1
└─ pug:3.0.2
└─ pug-code-gen:3.0.2
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Vulnerable Library - cypress-12.15.0.tgz
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
| CVE | Severity |  CVSS |
Dependency | Type | Fixed in (cypress version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-26136 |  Critical |
9.8 | tough-cookie-2.5.0.tgz | Transitive | 12.16.0 | ❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-26136RFC6265 Cookies and Cookie Jar for node.js
Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.5.0.tgz
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
Publish Date: 2023-07-01
URL: CVE-2023-26136
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136
Release Date: 2023-07-01
Fix Resolution (tough-cookie): 4.1.3
Direct dependency fix Resolution (cypress): 12.16.0
Step up your Open Source Security Game with Mend here
Please install our new product, Sonatype Lift with advanced features
Vulnerabilities
DepShield reports that this application's usage of ini:1.3.8 results in the following vulnerability(s):
Occurrences
ini:1.3.8 is a transitive dependency introduced by the following direct dependency(s):
• koromerzhin-dependencies:1.3.4
└─ gitmoji-changelog:2.3.0
└─ @gitmoji-changelog/core:2.3.0
└─ git-remote-origin-url:2.0.0
└─ gitconfiglocal:1.0.0
└─ ini:1.3.8
└─ libnpm:3.0.1
└─ libnpmconfig:1.2.1
└─ ini:1.3.8
└─ rc:1.2.8
└─ ini:1.3.8
└─ readme-md-generator:1.0.0
└─ git-repo-name:1.0.1
└─ remote-origin-url:2.0.0
└─ parse-git-config:3.0.0
└─ ini:1.3.8
└─ semantic-git-commit-cli:3.7.0
└─ findup-sync:4.0.0
└─ resolve-dir:1.0.1
└─ global-modules:1.0.0
└─ global-prefix:1.0.2
└─ ini:1.3.8
└─ update-notifier:2.5.0
└─ is-installed-globally:0.1.0
└─ global-dirs:0.1.1
└─ ini:1.3.8
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Vulnerable Library - yaml-2.1.3.tgzJavaScript parser and stringifier for YAML
Library home page: https://registry.npmjs.org/yaml/-/yaml-2.1.3.tgz
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (yaml version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-2251 |  High |
7.5 | yaml-2.1.3.tgz | Direct | 2.2.2 | ❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-2251JavaScript parser and stringifier for YAML
Library home page: https://registry.npmjs.org/yaml/-/yaml-2.1.3.tgz
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5.
Mend Note: After conducting further research, Mend has determined that CVE-2023-2251 only affects environments with versions 2.0.0-4--v2.2.1 of yaml.
Publish Date: 2023-04-24
URL: CVE-2023-2251
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-f9xv-q969-pqx4
Release Date: 2023-04-24
Fix Resolution: 2.2.2
Step up your Open Source Security Game with Mend here
Please install our new product, Sonatype Lift with advanced features
Vulnerabilities
DepShield reports that this application's usage of yargs-parser:7.0.0 results in the following vulnerability(s):
Occurrences
yargs-parser:7.0.0 is a transitive dependency introduced by the following direct dependency(s):
• koromerzhin-dependencies:1.3.4
└─ gitmoji-changelog:2.3.0
└─ libnpm:3.0.1
└─ lock-verify:2.2.1
└─ @iarna/cli:1.2.0
└─ yargs:8.0.2
└─ yargs-parser:7.0.0
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Please install our new product, Sonatype Lift with advanced features
Please install our new product, Sonatype Lift with advanced features
Vulnerabilities
DepShield reports that this application's usage of mem:1.1.0 results in the following vulnerability(s):
Occurrences
mem:1.1.0 is a transitive dependency introduced by the following direct dependency(s):
• koromerzhin-dependencies:1.3.4
└─ gitmoji-changelog:2.3.0
└─ libnpm:3.0.1
└─ lock-verify:2.2.1
└─ @iarna/cli:1.2.0
└─ yargs:8.0.2
└─ os-locale:2.1.0
└─ mem:1.1.0
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Please install our new product, Sonatype Lift with advanced features
Vulnerabilities
DepShield reports that this application's usage of lodash.clonedeep:4.5.0 results in the following vulnerability(s):
Occurrences
lodash.clonedeep:4.5.0 is a transitive dependency introduced by the following direct dependency(s):
• koromerzhin-dependencies:1.3.4
└─ gitmoji-changelog:2.3.0
└─ libnpm:3.0.1
└─ libnpmpublish:1.1.3
└─ lodash.clonedeep:4.5.0
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Please install our new product, Sonatype Lift with advanced features
Vulnerabilities
DepShield reports that this application's usage of bl:4.1.0 results in the following vulnerability(s):
Occurrences
bl:4.1.0 is a transitive dependency introduced by the following direct dependency(s):
• dockerode:3.3.4
└─ tar-fs:2.0.1
└─ tar-stream:2.2.0
└─ bl:4.1.0
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (jscpd version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-26143 | Critical |
9.1 | blamer-1.0.3.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-26143Library home page: https://registry.npmjs.org/blamer/-/blamer-1.0.3.tgz
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.
Publish Date: 2023-09-19
URL: CVE-2023-26143
Base Score Metrics:
Type: Upgrade version
Origin: https://gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9
Release Date: 2023-09-19
Fix Resolution: blamer - 1.0.4
Step up your Open Source Security Game with Mend here
Vulnerable Library - readme-md-generator-1.0.0.tgzPath to dependency file: /package.json
Path to vulnerable library: /node_modules/ejs/package.json
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (readme-md-generator version) | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2023-29827 | Critical |
9.8 | ejs-3.1.8.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
CVE-2023-29827Embedded JavaScript templates
Library home page: https://registry.npmjs.org/ejs/-/ejs-3.1.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ejs/package.json
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
** DISPUTED ** ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with untrusted input.
Publish Date: 2023-05-04
URL: CVE-2023-29827
Base Score Metrics:
Step up your Open Source Security Game with Mend here
Please install our new product, Sonatype Lift with advanced features
The project could not be analyzed because of build errors. Please review the error messages here. Another build will be scheduled when a change to a manifest file* occurs. If the build is successful this issue will be closed, otherwise the error message will be updated.
This is an automated GitHub Issue created by Sonatype DepShield. GitHub Apps, including DepShield, can be managed from the Developer settings of the repository administrators.
* Supported manifest files are: pom.xml, package.json, package-lock.json, npm-shrinkwrap.json, Cargo.lock, Cargo.toml, main.rs, lib.rs, build.gradle, build.gradle.kts, settings.gradle, settings.gradle.kts, gradle.properties, gradle-wrapper.properties, go.mod, go.sum
This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
These updates have all been created already. Click a checkbox below to force a retry/rebase of any.
node, @types/node).github/workflows/ci.yml
actions/checkout v4@3df4ab11eba7bda6032a0b82a6bb43b11571feacactions/cache v3
package.json
all-contributors-cli 6.26.*commander 11.0.*cypress 13.3.*dockerode 3.3.*dotenv 16.3.*generate-changelog 1.8.*gitmoji-changelog 2.3.*jscpd 3.5.*license-checker 25.0.*markdownlint-cli 0.37.*npm-run-all 4.1.*readme-md-generator 1.0.*semantic-git-commit-cli 3.7.*yaml 2.3.*@types/node 20.8.*typescript 5.2.*
.nvmrc
node v20.8.0
Vulnerable Library - gitmoji-changelog-2.3.0.tgz
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (gitmoji-changelog version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2022-25912 | Critical |
9.8 | simple-git-1.132.0.tgz | Transitive | N/A* | ❌ |
| CVE-2022-24433 | Critical |
9.8 | simple-git-1.132.0.tgz | Transitive | N/A* | ❌ |
| CVE-2022-24066 | Critical |
9.8 | simple-git-1.132.0.tgz | Transitive | N/A* | ❌ |
| CVE-2022-25881 | High |
7.5 | http-cache-semantics-3.8.1.tgz | Transitive | N/A* | ❌ |
| CVE-2023-28155 |  Medium |
6.1 | request-2.88.2.tgz | Transitive | N/A* | ❌ |
| CVE-2023-0842 | Medium |
5.3 | xml2js-0.4.23.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2022-25912Simple GIT interface for node.js
Library home page: https://registry.npmjs.org/simple-git/-/simple-git-1.132.0.tgz
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of CVE-2022-24066.
Publish Date: 2022-12-06
URL: CVE-2022-25912
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-25912
Release Date: 2022-12-06
Fix Resolution: simple-git - 3.15.0
Step up your Open Source Security Game with Mend here
CVE-2022-24433Simple GIT interface for node.js
Library home page: https://registry.npmjs.org/simple-git/-/simple-git-1.132.0.tgz
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary command execution.
Publish Date: 2022-03-11
URL: CVE-2022-24433
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-3f95-r44v-8mrg
Release Date: 2022-03-11
Fix Resolution: simple-git - 3.3.0
Step up your Open Source Security Game with Mend here
CVE-2022-24066Simple GIT interface for node.js
Library home page: https://registry.npmjs.org/simple-git/-/simple-git-1.132.0.tgz
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.
Publish Date: 2022-04-01
URL: CVE-2022-24066
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-28xr-mwxg-3qc8
Release Date: 2022-04-01
Fix Resolution: simple-git - 3.5.0
Step up your Open Source Security Game with Mend here
CVE-2022-25881Parses Cache-Control and other headers. Helps building correct HTTP caches and proxies
Library home page: https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-3.8.1.tgz
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
Publish Date: 2023-01-31
URL: CVE-2022-25881
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-rc47-6667-2j5j
Release Date: 2023-01-31
Fix Resolution: http-cache-semantics - 4.1.1;org.webjars.npm:http-cache-semantics:4.1.1
Step up your Open Source Security Game with Mend here
CVE-2023-28155Simplified HTTP request client.
Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
** UNSUPPORTED WHEN ASSIGNED ** The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Publish Date: 2023-03-16
URL: CVE-2023-28155
Base Score Metrics:
Step up your Open Source Security Game with Mend here
CVE-2023-0842Simple XML to JavaScript object converter.
Library home page: https://registry.npmjs.org/xml2js/-/xml2js-0.4.23.tgz
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.
Publish Date: 2023-04-05
URL: CVE-2023-0842
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-0842
Release Date: 2023-04-05
Fix Resolution: xml2js - 0.5.0
Step up your Open Source Security Game with Mend here
Please install our new product, Sonatype Lift with advanced features
Vulnerabilities
DepShield reports that this application's usage of lodash.includes:4.3.0 results in the following vulnerability(s):
Occurrences
lodash.includes:4.3.0 is a transitive dependency introduced by the following direct dependency(s):
• koromerzhin-dependencies:1.3.4
└─ semantic-git-commit-cli:3.7.0
└─ json-extra:0.5.0
└─ lodash.includes:4.3.0
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Vulnerable Library - semantic-git-commit-cli-3.7.0.tgz
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (semantic-git-commit-cli version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2022-33987 | Medium |
5.3 | got-6.7.1.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2022-33987Simplified HTTP requests
Library home page: https://registry.npmjs.org/got/-/got-6.7.1.tgz
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
Publish Date: 2022-06-18
URL: CVE-2022-33987
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33987
Release Date: 2022-06-18
Fix Resolution: got - 11.8.5,12.1.0
Step up your Open Source Security Game with Mend here
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.