Arthur de Jong

Open Source / Free Software developer

summaryrefslogtreecommitdiffstats
path: root/package-lock.json
Commit message (Collapse)AuthorAgeFilesLines
* Update NPM packagesHEADmasterArthur de Jong2024-02-241-594/+845
| | | | | | | | This includes a fix for CVE-2023-42282 in the IP package (because one of the transitive dependencies of node-sass switched to the ip-address module). The node-sass module is only used at build time and nothing in munin-plot does IP address validation so should not have been vulnerable.
* Update NPM packagesArthur de Jong2023-10-081-508/+594
| | | | | | Includes a fix for CVE-2023-44270 in postcss. The postcss package is only used to build the resulting CSS and as such is not run on untrusted data.
* Update NPM packagesArthur de Jong2023-07-291-113/+251
| | | | | | | | | | | | Includes the last dependency fix for CVE-2022-25883 (Regular Expression Denial of Service) in semver. Also includes the dependency fix for CVE-2023-26115 (Regular Expression Denial of Service) in word-wrap. Both packages were previously partially fixed in 1aa9d67 but now all dependencies have been updated. Neither packages should have run on untrusted data.
* Update NPM packagesArthur de Jong2023-07-091-695/+361
| | | | | | | | | | | | Includes a partial fix CVE-2023-26115 (Regular Expression Denial of Service) in word-wrap. While word-wrap was used in the built application the vulnerable version is now only used in a dependency of munin-plot build tools. It should not have been run on any untrusted data. This does not completely fix CVE-2022-25883 (Regular Expression Denial of Service) in semver because of dependency issues. The semver package is only used to build the resulting Javascript and as such is not run on untrusted data.
* Update NPM packagesArthur de Jong2023-04-291-423/+505
| | | | | | Includes a fix for CVE-2023-28154 in webpack. This vulnerability does not seem to impact munin-plot because we don't run webpack on untrusted input.
* Update NPM packagesArthur de Jong2023-02-051-153/+298
| | | | | | | | | | | Includes a fix for a vulnerability in d3-color is available yet (no CVE for GHSA-36jr-mh4h-2g58 has been assigned). Since we only pass data to d3 that is generated by the server-side component this should not affect munin-plot. Also includes a fix for CVE-2022-25881 in http-cache-semantics which does not affect munin-plot because it only affects server-side applications.
* Update NPM packagesArthur de Jong2023-01-031-7441/+702
| | | | | | | | | | | | | | | | | This upgrades to version 7 of eslint which results in some minor other changes. Sadly no fix for CVE-2022-46175 in json5 (a transitive dependency of eslint) is available yet. This vulnerability should not affect munin-plot because we don't run eslint on untrusted input. Sadly no fix for a vulnerability in d3-color is available yet (no CVE for GHSA-36jr-mh4h-2g58 has been assigned) because there is not yet a version of plotly.js available that doesn't depend on a version of d3-interpolate that doesn't depend on the vulnerable package. This could affect munin-plot because d3 is used in the web application but we only pass data to d3 (via plotly.js) that is output of the munin-plot server-side component.
* Update NPM packagesArthur de Jong2022-11-201-1237/+964
| | | | | | | | | | | | | | Includes a fixes for CVE-2022-37601 and CVE-2022-37603 in webpack loader-utils. These vulnerabilities does not seem to impact munin-plot because we don't run webpack on untrusted input. Sadly no fix for a vulnerability in d3-color is available yet (no CVE for GHSA-36jr-mh4h-2g58 has been assigned) because there is not yet a version of plotly.js available that doesn't depend on a version of d3-interpolate that doesn't depend on the vulnerable package. This could affect munin-plot because d3 is unsed in the web application but we only pass data to d3 (through plotly.js) that is output from the the munin-plot server-side component.
* Update NPM packagesArthur de Jong2022-10-081-650/+520
| | | | | | | | | | | | | | Includes a fix for CVE-2022-25758 in scss-tokenizer. This vulnerability does not seem to impact munin-plot because we don't run node-sass on untrusted input. Sadly no fix for a vulnerability in d3-color is available yet (no CVE for GHSA-36jr-mh4h-2g58 has been assigned) because there is not yet a version of plotly.js available that doesn't depend on a version of d3-interpolate that doesn't depend on the vulnerable package. This could affect munin-plot because d3 is unsed in the web application but we only pass data to d3 (through plotly.js) that is output from the the munin-plot server-side component.
* Update NPM packagesArthur de Jong2022-07-231-1323/+1475
| | | | | | | | | | | | | | | | | | Includes a fix for CVE-2022-31160 in jQuery UI. This vulnerability does not seem to impact munin-plot because we don't use radio buttons. Includes a fix for CVE-2022-24785 in Moment.js This vulnerability does not seem to impact munin-plot because it should only affect server-side Javascript. Includes a fix for CVE-2022-25858 in terser. This is used by webpack and should not affect impact munin-plot because it does not run webpack on untrusted input. Sadly no fix for CVE-2022-25758 is available at this time because there is not yet a version of node-sass available that doesn't depend on the scss-tokenizer package (which appears to be unmaintained). Since we don't process untrusted SCSS it should not affect munin-plot.
* Update NPM packagesArthur de Jong2022-03-271-526/+493
| | | | | Includes a fix for CVE-2021-44906 in the minimist package which is a transitive dependency of plotly.js.
* Update NPM packagesArthur de Jong2022-01-291-1480/+1492
| | | | | | Includes fixes for CVE-2021-3807 in the ansi-regex package and CVE-2021-23566 in nanoid both of which should only be used to build the resulting Javascript.
* Use pako for compressionArthur de Jong2022-01-031-0/+11
| | | | | The Compression Streams API is not yet widely supported in browsers (i.e. is unsupported in FireFox).
* Provide munin-plot source code as downloadArthur de Jong2021-12-301-0/+621
| | | | | This generates a zip file with the source code of munin-plot as a resource that can be downloaded.
* Update NPM packagesArthur de Jong2021-12-121-812/+1466
|
* Update NPM packagesArthur de Jong2021-11-061-2890/+398
|
* Update NPM packagesArthur de Jong2021-10-151-836/+864
| | | | This include a CSS tweak for a change in Bootstrap.
* Update NPM packagesArthur de Jong2021-09-191-438/+353
|
* Upgrade to Bootstrap 5Arthur de Jong2021-09-031-26/+25
| | | | | | This updates the events that are handled in Javascript to no longer use jQuery and stops the use of Bootstrap tooltips. Bootstrap introduces slightly different font sizes and we include some changes to padding.
* Update to Plotly.js 2.4Arthur de Jong2021-09-031-253/+1153
| | | | This includes some changes to import D3 ourselves.
* Update NPM packagesArthur de Jong2021-09-031-210/+268
| | | | | Includes fixes for CVE-2021-37713 in the tar npm package (that should not affect us).
* Update NPM packagesArthur de Jong2021-08-131-75/+81
| | | | Includes changes that should have been part of 8cf2053.
* Update NPM packagesArthur de Jong2021-08-101-448/+548
| | | | | Includes fixes for CVE-2021-32804 and CVE-2021-32803 in the tar npm package.
* Update some NPM packagesArthur de Jong2021-07-091-2334/+1820
| | | | | | | | This includes an update to html-loader that requires a small configurmation change. This does not include new major versions of Bootstrap 5 and Plotly.js 2 that are also available.
* Update some NPM packagesArthur de Jong2021-05-021-811/+852
|
* Update some NPM packagesArthur de Jong2021-01-311-1008/+889
|
* Update some NPM packagesArthur de Jong2020-12-201-4514/+10810
| | | | | | | | | Includes a fix for CVE-2020-7788 in ini npm package. This upgrades to newer eslint and webpack and includes a few fixes for that. Closes https://github.com/arthurdejong/munin-plot/pull/6
* Update some NPM packagesArthur de Jong2020-09-041-513/+486
|
* Update some NPM packagesArthur de Jong2020-07-221-730/+312
| | | | Closes https://github.com/arthurdejong/munin-plot/pull/5
* Update some NPM packagesArthur de Jong2020-06-201-655/+167
|
* Update some NPM packagesArthur de Jong2020-06-131-1427/+1156
|
* Update some NPM packagesArthur de Jong2020-04-101-776/+943
| | | | Closes https://github.com/arthurdejong/munin-plot/pull/3
* Update some NPM packagesArthur de Jong2020-01-191-2414/+2450
|
* Switch from Open Iconic to Font AwesomeArthur de Jong2019-12-311-35/+24
| | | | | The latter has more icons and the former no longer seems to be supported.
* Add navigation bar with date range selectorArthur de Jong2019-12-301-0/+14
| | | | | This also adds a few small style tweaks and ensures that webpack does not minimise development builds.
* Use ESLint to check code styleArthur de Jong2019-12-301-200/+1391
|
* Use webpack to build Javascript partArthur de Jong2019-12-301-0/+10413
This uses npm to install the required packages and builds the files with webpack.