npm audit fails: upgrade handlebars >=4.5.3
See original GitHub issue- Newman Version (can be found via
newman -v
): 4.5.6 - OS details (type, version, and architecture): Mac OS
- Are you using Newman as a library, or via the CLI? CLI
- Did you encounter this recently, or has this bug always been there: recently
- Expected behaviour: npm audit passes
- Command / script used to run Newman: npm audit
- Sample collection, and auxiliary files (minus the sensitive details): NA
- Screenshots (if applicable):
$ cat package.json
{
"dependencies": {
"newman": "^4.5.6"
}
}
$ npm audit
=== npm audit security report ===
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β Manual Review β
β Some vulnerabilities require your attention to resolve β
β β
β Visit https://go.npm.me/audit-guide for additional guidance β
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
βββββββββββββββββ¬βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β High β Arbitrary Code Execution β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Package β handlebars β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Patched in β >=4.5.2 β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Dependency of β newman β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Path β newman > postman-runtime > handlebars β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β More info β https://npmjs.com/advisories/1316 β
βββββββββββββββββ΄βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
βββββββββββββββββ¬βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β High β Arbitrary Code Execution β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Package β handlebars β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Patched in β >=4.5.3 β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Dependency of β newman β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Path β newman > postman-runtime > handlebars β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β More info β https://npmjs.com/advisories/1324 β
βββββββββββββββββ΄βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
βββββββββββββββββ¬βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β High β Prototype Pollution β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Package β handlebars β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Patched in β >=4.5.3 β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Dependency of β newman β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Path β newman > postman-runtime > handlebars β
βββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β More info β https://npmjs.com/advisories/1325 β
βββββββββββββββββ΄βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
found 3 high severity vulnerabilities in 357 scanned packages
3 vulnerabilities require manual review. See the full report for details.
Issue Analytics
- State:
- Created 4 years ago
- Reactions:9
- Comments:9 (3 by maintainers)
Top Results From Across the Web
handlebars@4.5.3 - Snyk Vulnerability Database
handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Prototype Pollution when selecting certainΒ ...
Read more >Auditing package dependencies for security vulnerabilities
To upgrade, run npm install npm@latest -g . The npm audit command submits a description of the dependencies configured in your package to...
Read more >npm err! node-sass@7.0.3 postinstall: `node scripts/build.js` - You ...
I'm working on my first node.js project and am using handlebars for templating. When I deployed through Heroku today I got a 500...
Read more >Changelog - Cypress Documentation
Fixed an issue where the Cypress migration wizard would fail to run in global mode ... Installing Cypress on your system now requires...
Read more >Changelog - Nextcloud
Update timely and don't run unmaintained Nextcloud versions. ... Prevent throwing an error in node deletion hook (photos#1493) Β· Run npm audit fixΒ ......
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Please fix this!
@shamasis thanks - thats good enough for me - please close this issue when its patched to let us know! Cheers! (and by the way absolutely love Postman and esp.
newman
keep up the great work - sorry if I came off as angry haha)