From 288896f4ef574ae73d8047527e1337636ee9349d Mon Sep 17 00:00:00 2001 From: Benjamin Franzke Date: Wed, 24 Aug 2022 08:35:20 +0200 Subject: [PATCH] [TASK] Update vulnerable build dependencies MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Update (most) vulnerable dependencies/packages found by `npm audit fix --force --dry-run`. Notes redarding package changes: * The outdated grunt-postcss plugin is replaced by a (maintained) fork for compatibility with newer grunt versions. * karma is updated to v6 and pulls in @types/node which conflicts with TypeScript type definitions by @types/requirejs. Therefore 3rd party type declarations from packages (@types/*) are now explicitly enabled in tsconfig.json – note that there is no other way to exclude from typeRoots: https://github.com/microsoft/TypeScript/issues/18588 * grunt-lintspaces and grunt-contrib-imagemin are replaced as these packages have been not been updated to not depend on vulnerabe dependencies, while grunt-lintspaces and grunt-contrib-imagemin would cause downgrades to older version when running `npm audit fix --force` (because only the older versions do not depend on vulnerable software). * (grunt-contrib-)imagemin is replaced by squoosh (by google) as a) imagemin dependencies ("bin-build" > "download") rely on vulnerable versions of "got". Neither of these packages is currently updated,see https://github.com/kevva/download/issues/224 b) imagemin is unmaintained: https://github.com/imagemin/imagemin/issues/385 and suggests squoosh as replacement * stylefmt is replaced by a maintained fork. There is one remaining packages that pulls in a vulnerability alerts: * jquery-ui is marked as vulnerable (severity: high), but worked on in a separate patch #96497. (We don't actually use the vulnerable library parts though). Vulnerability report before this patch: 74 vulnerabilities (1 low, 30 moderate, 38 high, 5 critical) Vulnerability report after this patch: 1 high severity vulnerability (this is jquery-ui) Commands executed: # Supposed to be non breaking, but broke grunt-css npm audit fix npm remove grunt-postcss npm install @lodder/grunt-postcss # Preparation for `npm audit fix --force` (breaking changes) npm install grunt@^1.5 npm install grunt-lintspaces@^0.10.0 npm remove grunt-lintspaces npm install --save-dev lintspaces-cli npm remove grunt-contrib-imagemin npm install --save-dev npm remove stylefmt npm install --save-dev @ronilaukkarinen/stylefmt npm audit fix --force Releases: main Resolves: #98198 Change-Id: I09df87fe131a499790e6c5f95f1c51e9216b71c2 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75539 Tested-by: core-ci Tested-by: Georg Ringer Tested-by: Stefan Bürk Tested-by: Benjamin Franzke Reviewed-by: Georg Ringer Reviewed-by: Stefan Bürk Reviewed-by: Benjamin Franzke --- Resources/Public/JavaScript/recycler.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Resources/Public/JavaScript/recycler.js b/Resources/Public/JavaScript/recycler.js index 061e88a..c185bf1 100644 --- a/Resources/Public/JavaScript/recycler.js +++ b/Resources/Public/JavaScript/recycler.js @@ -10,4 +10,4 @@ * * The TYPO3 project - inspiring people to share! */ -import $ from"jquery";import NProgress from"nprogress";import"@typo3/backend/input/clearable.js";import"@typo3/backend/element/icon-element.js";import DeferredAction from"@typo3/backend/action-button/deferred-action.js";import Modal from"@typo3/backend/modal.js";import Notification from"@typo3/backend/notification.js";import Severity from"@typo3/backend/severity.js";import RegularEvent from"@typo3/core/event/regular-event.js";var RecyclerIdentifiers;!function(e){e.searchForm="#recycler-form",e.searchText="#recycler-form [name=search-text]",e.searchSubmitBtn="#recycler-form button[type=submit]",e.depthSelector="#recycler-form [name=depth]",e.tableSelector="#recycler-form [name=pages]",e.recyclerTable="#itemsInRecycler",e.paginator="#recycler-index nav",e.reloadAction="a[data-action=reload]",e.undo="a[data-action=undo]",e.delete="a[data-action=delete]",e.massUndo="button[data-multi-record-selection-action=massundo]",e.massDelete="button[data-multi-record-selection-action=massdelete]"}(RecyclerIdentifiers||(RecyclerIdentifiers={}));class Recycler{constructor(){this.elements={},this.paging={currentPage:1,totalPages:1,totalItems:0,itemsPerPage:TYPO3.settings.Recycler.pagingSize},this.markedRecordsForMassAction=[],this.handleCheckboxStateChanged=e=>{const t=$(e.target),a=t.parents("tr"),s=a.data("table")+":"+a.data("uid");if(t.prop("checked"))this.markedRecordsForMassAction.push(s);else{const e=this.markedRecordsForMassAction.indexOf(s);e>-1&&this.markedRecordsForMassAction.splice(e,1)}this.markedRecordsForMassAction.length>0?(this.elements.$massUndo.find("span.text").text(this.createMessage(TYPO3.lang["button.undoselected"],[this.markedRecordsForMassAction.length])),this.elements.$massDelete.find("span.text").text(this.createMessage(TYPO3.lang["button.deleteselected"],[this.markedRecordsForMassAction.length]))):this.resetMassActionButtons()},this.deleteRecord=e=>{if(TYPO3.settings.Recycler.deleteDisable)return;const t=$(e.target).parents("tr"),a="TBODY"!==t.parent().prop("tagName");let s,n;if(a)s=this.markedRecordsForMassAction,n=TYPO3.lang["modal.massdelete.text"];else{const e=t.data("uid"),a=t.data("table"),i=t.data("recordtitle");s=[a+":"+e],n="pages"===a?TYPO3.lang["modal.deletepage.text"]:TYPO3.lang["modal.deletecontent.text"],n=this.createMessage(n,[i,"["+s[0]+"]"])}Modal.confirm(TYPO3.lang["modal.delete.header"],n,Severity.error,[{text:TYPO3.lang["button.cancel"],btnClass:"btn-default",trigger:function(){Modal.dismiss()}},{text:TYPO3.lang["button.delete"],btnClass:"btn-danger",action:new DeferredAction(()=>Promise.resolve(this.callAjaxAction("delete",s,a)))}])},this.undoRecord=e=>{const t=$(e.target).parents("tr"),a="TBODY"!==t.parent().prop("tagName");let s,n,i;if(a)s=this.markedRecordsForMassAction,n=TYPO3.lang["modal.massundo.text"],i=!0;else{const e=t.data("uid"),a=t.data("table"),r=t.data("recordtitle");s=[a+":"+e],i="pages"===a,n=i?TYPO3.lang["modal.undopage.text"]:TYPO3.lang["modal.undocontent.text"],n=this.createMessage(n,[r,"["+s[0]+"]"]),i&&t.data("parentDeleted")&&(n+=TYPO3.lang["modal.undo.parentpages"])}let r=null;r=i?$("
").append($("

").text(n),$("

",{class:"form-check"}).append($("",{type:"checkbox",id:"undo-recursive",class:"form-check-input"}),$("