mirror of
https://github.com/actualbudget/actual.git
synced 2026-07-15 22:54:03 -05:00
[Bug]: Critical security vulnerabilities found in package dependencies #145
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/actual#145
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @biohzrddd on GitHub (Nov 16, 2022).
Verified issue does not already exist?
I have searched and found no existing issue
What happened?
Google Cloud vulnerability scan found the following:
1x critical
1x High
5x Medium
Many x Low
The dependencies for actual-* need updated/replaced to fix vulnerabilities.
What error did you receive?
See What Happened?
Where are you hosting Actual?
Other
What browsers are you seeing the problem on?
Other
Operating System
Linux
@jlongster commented on GitHub (Nov 16, 2022):
This is very vague. Please dig in and provide concrete steps for what we need to do. Often, these kinds of vulnerability scans are useless as they find thing that are only run in development mode, etc. We have very few binary deps and none of those packages look relevant to Actual. If you can't give us more concrete steps or description of what's wrong, we'll close this issue.
@biohzrddd commented on GitHub (Nov 16, 2022):
It appears Google Cloud's Container Scanning API was scanning the OS and not any of the node.js packages Actual depends on. Closing, sorry for the confusion!