{"action":"closed","issue":{"url":"https://api.github.com/repos/brave/brave-browser/issues/130","repository_url":"https://api.github.com/repos/brave/brave-browser","labels_url":"https://api.github.com/repos/brave/brave-browser/issues/130/labels{/name}","comments_url":"https://api.github.com/repos/brave/brave-browser/issues/130/comments","events_url":"https://api.github.com/repos/brave/brave-browser/issues/130/events","html_url":"https://github.com/brave/brave-browser/issues/130","id":309447700,"node_id":"MDU6SXNzdWUzMDk0NDc3MDA=","number":130,"title":"NSP check should pass","user":{"login":"bbondy","id":831718,"node_id":"MDQ6VXNlcjgzMTcxOA==","avatar_url":"https://avatars2.githubusercontent.com/u/831718?v=4","gravatar_id":"","url":"https://api.github.com/users/bbondy","html_url":"https://github.com/bbondy","followers_url":"https://api.github.com/users/bbondy/followers","following_url":"https://api.github.com/users/bbondy/following{/other_user}","gists_url":"https://api.github.com/users/bbondy/gists{/gist_id}","starred_url":"https://api.github.com/users/bbondy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bbondy/subscriptions","organizations_url":"https://api.github.com/users/bbondy/orgs","repos_url":"https://api.github.com/users/bbondy/repos","events_url":"https://api.github.com/users/bbondy/events{/privacy}","received_events_url":"https://api.github.com/users/bbondy/received_events","type":"User","site_admin":false},"labels":[{"id":999211159,"node_id":"MDU6TGFiZWw5OTkyMTExNTk=","url":"https://api.github.com/repos/brave/brave-browser/labels/audit-beta","name":"audit-beta","color":"095663","default":false},{"id":882844408,"node_id":"MDU6TGFiZWw4ODI4NDQ0MDg=","url":"https://api.github.com/repos/brave/brave-browser/labels/security","name":"security","color":"ed82a9","default":false}],"state":"closed","locked":false,"assignee":{"login":"NejcZdovc","id":9574457,"node_id":"MDQ6VXNlcjk1NzQ0NTc=","avatar_url":"https://avatars1.githubusercontent.com/u/9574457?v=4","gravatar_id":"","url":"https://api.github.com/users/NejcZdovc","html_url":"https://github.com/NejcZdovc","followers_url":"https://api.github.com/users/NejcZdovc/followers","following_url":"https://api.github.com/users/NejcZdovc/following{/other_user}","gists_url":"https://api.github.com/users/NejcZdovc/gists{/gist_id}","starred_url":"https://api.github.com/users/NejcZdovc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NejcZdovc/subscriptions","organizations_url":"https://api.github.com/users/NejcZdovc/orgs","repos_url":"https://api.github.com/users/NejcZdovc/repos","events_url":"https://api.github.com/users/NejcZdovc/events{/privacy}","received_events_url":"https://api.github.com/users/NejcZdovc/received_events","type":"User","site_admin":false},"assignees":[{"login":"NejcZdovc","id":9574457,"node_id":"MDQ6VXNlcjk1NzQ0NTc=","avatar_url":"https://avatars1.githubusercontent.com/u/9574457?v=4","gravatar_id":"","url":"https://api.github.com/users/NejcZdovc","html_url":"https://github.com/NejcZdovc","followers_url":"https://api.github.com/users/NejcZdovc/followers","following_url":"https://api.github.com/users/NejcZdovc/following{/other_user}","gists_url":"https://api.github.com/users/NejcZdovc/gists{/gist_id}","starred_url":"https://api.github.com/users/NejcZdovc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NejcZdovc/subscriptions","organizations_url":"https://api.github.com/users/NejcZdovc/orgs","repos_url":"https://api.github.com/users/NejcZdovc/repos","events_url":"https://api.github.com/users/NejcZdovc/events{/privacy}","received_events_url":"https://api.github.com/users/NejcZdovc/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/brave/brave-browser/milestones/3","html_url":"https://github.com/brave/brave-browser/milestone/3","labels_url":"https://api.github.com/repos/brave/brave-browser/milestones/3/labels","id":2960312,"node_id":"MDk6TWlsZXN0b25lMjk2MDMxMg==","number":3,"title":"Releasable builds","description":"Date is subject to change, and a call will be made at the start of August.","creator":{"login":"bbondy","id":831718,"node_id":"MDQ6VXNlcjgzMTcxOA==","avatar_url":"https://avatars2.githubusercontent.com/u/831718?v=4","gravatar_id":"","url":"https://api.github.com/users/bbondy","html_url":"https://github.com/bbondy","followers_url":"https://api.github.com/users/bbondy/followers","following_url":"https://api.github.com/users/bbondy/following{/other_user}","gists_url":"https://api.github.com/users/bbondy/gists{/gist_id}","starred_url":"https://api.github.com/users/bbondy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bbondy/subscriptions","organizations_url":"https://api.github.com/users/bbondy/orgs","repos_url":"https://api.github.com/users/bbondy/repos","events_url":"https://api.github.com/users/bbondy/events{/privacy}","received_events_url":"https://api.github.com/users/bbondy/received_events","type":"User","site_admin":false},"open_issues":82,"closed_issues":221,"state":"open","created_at":"2017-12-05T19:44:03Z","updated_at":"2018-07-23T21:08:07Z","due_on":"2018-09-07T07:00:00Z","closed_at":null},"comments":2,"created_at":"2018-03-28T16:50:33Z","updated_at":"2018-07-23T21:08:07Z","closed_at":"2018-07-23T21:08:06Z","author_association":"MEMBER","body":"This is only used for the dev deps, but we should fix this:\r\n\r\n```\r\n$ nsp check\r\n(+) 2 vulnerabilities found\r\n┌────────────┬────────────────────────────────────────────────────────────────────┐\r\n│            │ Prototype pollution attack                                         │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Name       │ hoek                                                               │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ CVSS       │ 4 (Medium)                                                         │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Installed  │ 2.16.3                                                             │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Vulnerable │ <= 4.2.0 || >= 5.0.0 < 5.0.3                                       │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Patched    │ > 4.2.0 < 5.0.0 || >= 5.0.3                                        │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Path       │ brave@1.0.0 > less@2.7.3 > request@2.81.0 > hawk@3.1.3 >           │\r\n│            │ hoek@2.16.3                                                        │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ More Info  │ https://nodesecurity.io/advisories/566                             │\r\n└────────────┴────────────────────────────────────────────────────────────────────┘\r\n\r\n┌────────────┬────────────────────────────────────────────────────────────────────┐\r\n│            │ Prototype pollution attack                                         │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Name       │ hoek                                                               │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ CVSS       │ 4 (Medium)                                                         │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Installed  │ 2.16.3                                                             │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Vulnerable │ <= 4.2.0 || >= 5.0.0 < 5.0.3                                       │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Patched    │ > 4.2.0 < 5.0.0 || >= 5.0.3                                        │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Path       │ brave@1.0.0 > nsp@3.2.1 > wreck@12.5.1 > boom@5.2.0 > hoek@2.16.3  │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ More Info  │ https://nodesecurity.io/advisories/566                             │\r\n└────────────┴────────────────────────────────────────────────────────────────────┘\r\n```\r\n\r\n\r\n\r\nfor the nsp chck, looks like it's included here:\r\n```\r\nBrians-MacBook-Pro:brave bbondy$ npm ls hoek\r\nbrave@1.0.0 /Users/bbondy/projects/brave/brave\r\n├─┬ less@2.7.3\r\n│ └─┬ request@2.81.0\r\n│   └─┬ hawk@3.1.3\r\n│     ├─┬ boom@2.10.1\r\n│     │ └── hoek@2.16.3  deduped\r\n│     ├── hoek@2.16.3\r\n│     └─┬ sntp@1.0.9\r\n│       └── hoek@2.16.3  deduped\r\n└─┬ webpack@3.10.0\r\n  └─┬ watchpack@1.4.0\r\n    └─┬ chokidar@1.7.0\r\n      └─┬ fsevents@1.1.3\r\n        └─┬ node-pre-gyp@0.6.39\r\n          └─┬ hawk@3.1.3\r\n            ├─┬ boom@2.10.1\r\n            │ └── hoek@2.16.3  deduped\r\n            ├── hoek@2.16.3\r\n            └─┬ sntp@1.0.9\r\n              └── hoek@2.16.3  deduped\r\n```\r\n\r\nI tried updating all node modules with ncu, but it's not fixed.\r\nI did a fresh npm install after clearing node_modules with that.\r\n\r\nMaybe we should just add it to the ignored list?\r\n\r\nBy the way I did the same check in src/brave as well and it says `(+) No known vulnerabilities found`"}}
{"actor":{"display_login":"jumde"}}