Stuck on an issue?
Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.
And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.
Long summary output for only one vulnerable advisory
See original GitHub issueWe have a warning for this advisory in our system: https://github.com/advisories/GHSA-xvch-5gv4-984h
But the summary output of the audit-ci run does not look good in my opinion:
$ audit-ci --config audit-config.json
audit-ci version: 6.1.0
Yarn audit report summary:
{
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 0,
"high": 10,
"critical": 0
},
"dependencies": XXX,
"devDependencies": 0,
"optionalDependencies": 0,
"totalDependencies": XXX
}
Found vulnerable advisory paths:
GHSA-xvch-5gv4-984h|esdoc>minimist
GHSA-xvch-5gv4-984h|@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|fetch-mock>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/reporters>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|esdoc>minimist
GHSA-xvch-5gv4-984h|@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|fetch-mock>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/reporters>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|esdoc>minimist
GHSA-xvch-5gv4-984h|@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|fetch-mock>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/reporters>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|esdoc>minimist
GHSA-xvch-5gv4-984h|@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|fetch-mock>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/reporters>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|esdoc>minimist
GHSA-xvch-5gv4-984h|@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|fetch-mock>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/reporters>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|esdoc>minimist
GHSA-xvch-5gv4-984h|@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|fetch-mock>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/reporters>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|esdoc>minimist
GHSA-xvch-5gv4-984h|@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|fetch-mock>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/reporters>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|esdoc>minimist
GHSA-xvch-5gv4-984h|@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|fetch-mock>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/reporters>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|esdoc>minimist
GHSA-xvch-5gv4-984h|@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|fetch-mock>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/reporters>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|esdoc>minimist
GHSA-xvch-5gv4-984h|@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|fetch-mock>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/reporters>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|esdoc>minimist
GHSA-xvch-5gv4-984h|@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|fetch-mock>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/reporters>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|esdoc>minimist
GHSA-xvch-5gv4-984h|@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|fetch-mock>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>@jest/reporters>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>babel-jest>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
GHSA-xvch-5gv4-984h|jest>jest-cli>@jest/core>jest-config>@jest/test-sequencer>jest-runtime>jest-snapshot>@jest/transform>babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5>minimist
Failed security audit due to high vulnerabilities.
Vulnerable advisories are:
https://github.com/advisories/GHSA-xvch-5gv4-984h
Exiting...
error Command failed with exit code 1.
Of course we just need to upgrade minimist and the output goes away, but I do think that the summary should be displayed differently here.
I will try to find time to create a dummy repo for this, but for now here the needed yarn.lock and audit-config.json content.
# needed minimist version
minimist@^1.2.5:
version "1.2.5"
resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.5.tgz#67d66014b66a6a8aaa0c083c5fd58df4e4e97602"
integrity sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==
audit-config.json
{
"low": true,
"package-manager": "yarn",
"report-type": "summary",
"allowlist": []
}
Issue Analytics
- State:
- Created a year ago
- Comments:6 (6 by maintainers)
Top Results From Across the Web
Active Exploitation of Confluence CVE-2022-26134 - Rapid7
On June 2, 2022, Atlassian published an advisory for CVE-2022-26134, a critical unauthenticated RCE vulnerability in Confluence Serve and ...
Read more >SARIF support for code scanning - GitHub Docs
SARIF (Static Analysis Results Interchange Format) is an OASIS Standard that defines an output file format. The SARIF standard is used to streamline...
Read more >BitLocker mitigation plan for vulnerability in TPM
Summary. A security vulnerability exists in certain Trusted Platform Module (TPM) chipsets. The vulnerability weakens key strength.
Read more >Threat Actors Chaining Unpatched VMware Vulnerabilities for ...
These vulnerabilities affect certain versions of VMware Workspace ONE Access, VMware Identity Manager (vIDM), VMware vRealize Automation (vRA), ...
Read more >New `composer audit` Command and security ... - PHP.Watch
The output of the composer audit command includes all reported security vulnerabilities that match the version and package name of the advisory's indicated ......
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Fix released in
v6.1.2thanks to Kyle!Released with
v6.1.1on NPM now!