Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

security: update axios and yargs-parser #20

Open
AlJohri opened this issue Jan 28, 2021 · 3 comments
Open

security: update axios and yargs-parser #20

AlJohri opened this issue Jan 28, 2021 · 3 comments

Comments

@AlJohri
Copy link

AlJohri commented Jan 28, 2021

❯ npm audit
# npm audit report

axios  <0.21.1
Severity: high
Server-Side Request Forgery - https://npmjs.com/advisories/1594
No fix available
node_modules/axios
  @mobileposse/auto-delete-bucket  *
  Depends on vulnerable versions of axios
  node_modules/@mobileposse/auto-delete-bucket

yargs-parser  <=13.1.1 || 14.0.0 - 15.0.0 || 16.0.0 - 18.1.1
Prototype Pollution - https://npmjs.com/advisories/1500
No fix available
node_modules/yargs-parser
  meow  5.0.0 - 6.0.1
  Depends on vulnerable versions of yargs-parser
  node_modules/meow
    ts-clean  *
    Depends on vulnerable versions of meow
    node_modules/ts-clean

5 vulnerabilities (3 low, 2 high)

Some issues need review, and may require choosing
a different dependency.
@danconner-vertex
Copy link

our team would also be grateful for this upgrade.

@rwpswami
Copy link

rwpswami commented Apr 6, 2021

I think Axios has upgraded. Waiting for a new release.

@E-Rick
Copy link

E-Rick commented Apr 8, 2021

Hey @rwpswami @danconner-vertex ,

The option to auto delete objects upon bucket removal was added to the core functionality of aws-cdk recently. aws-cdk#3297 🥳

You just have to enable the autoDeleteObjects option and set removal policy to RemovalPolicy.DESTROY when creating the S3 bucket.

const bucket = new Bucket(this, 'MyTempFileBucket', {
  removalPolicy: RemovalPolicy.DESTROY,
  autoDeleteObjects: true,
});

See the official AWS CDK documentation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants