Skip to content

Commit b05be93

Browse files
nkaramarkonkaramarko
authored
Merge pull request #9134 from wireapp/security/critical-deps
chore: enhance critical dependency [WPB-20016]
2 parents 5e30373 + fdc9bf2 commit b05be93

File tree

4 files changed

+214
-59
lines changed

4 files changed

+214
-59
lines changed

‎.github/workflows/dependency-audit.yml‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
name: Dependency Security Audit
2+
3+
on:
4+
pull_request:
5+
branches: [main, dev, staging]
6+
7+
push:
8+
branches: [main, dev, staging]
9+
10+
schedule:
11+
- cron: '0 9 * * 1' # 9 AM UTC every Monday
12+
13+
workflow_dispatch:
14+
15+
permissions:
16+
contents: read
17+
security-events: write
18+
pull-requests: write
19+
20+
concurrency:
21+
group: dependency-audit-${{ github.ref }}
22+
cancel-in-progress: true
23+
24+
jobs:
25+
audit:
26+
name: Dependency Vulnerability Audit
27+
runs-on: ubuntu-latest
28+
29+
steps:
30+
- name: Checkout repository
31+
uses: actions/checkout@v4
32+
33+
- name: Setup Node.js
34+
uses: actions/setup-node@v4
35+
with:
36+
node-version: 18.x
37+
cache: 'yarn'
38+
39+
- name: Install dependencies
40+
run: yarn --immutable
41+
42+
- name: Run Yarn Audit
43+
id: yarn-audit
44+
run: |
45+
echo "Running yarn npm audit..."
46+
yarn npm audit --all --recursive --json > audit-results.json || true
47+
48+
# Parse results
49+
CRITICAL=$(cat audit-results.json | jq -r '.metadata.vulnerabilities.critical // 0')
50+
HIGH=$(cat audit-results.json | jq -r '.metadata.vulnerabilities.high // 0')
51+
MODERATE=$(cat audit-results.json | jq -r '.metadata.vulnerabilities.moderate // 0')
52+
LOW=$(cat audit-results.json | jq -r '.metadata.vulnerabilities.low // 0')
53+
54+
echo "critical=$CRITICAL" >> $GITHUB_OUTPUT
55+
echo "high=$HIGH" >> $GITHUB_OUTPUT
56+
echo "moderate=$MODERATE" >> $GITHUB_OUTPUT
57+
echo "low=$LOW" >> $GITHUB_OUTPUT
58+
59+
# Create summary
60+
echo "## Dependency Audit Results" >> $GITHUB_STEP_SUMMARY
61+
echo "" >> $GITHUB_STEP_SUMMARY
62+
echo "| Severity | Count |" >> $GITHUB_STEP_SUMMARY
63+
echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
64+
echo "| 🔴 Critical | $CRITICAL |" >> $GITHUB_STEP_SUMMARY
65+
echo "| 🟠 High | $HIGH |" >> $GITHUB_STEP_SUMMARY
66+
echo "| 🟡 Moderate | $MODERATE |" >> $GITHUB_STEP_SUMMARY
67+
echo "| 🟢 Low | $LOW |" >> $GITHUB_STEP_SUMMARY
68+
69+
# Generate detailed report
70+
yarn npm audit --all --recursive > audit-report.txt || true
71+
72+
- name: Upload audit results
73+
uses: actions/upload-artifact@v4
74+
with:
75+
name: dependency-audit-results
76+
path: |
77+
audit-results.json
78+
audit-report.txt
79+
retention-days: 30
80+
81+
- name: Check for critical vulnerabilities
82+
if: steps.yarn-audit.outputs.critical != '0'
83+
run: |
84+
echo "::error::Found ${{ steps.yarn-audit.outputs.critical }} critical vulnerabilities!"
85+
echo "Please review the audit results and update vulnerable dependencies."
86+
cat audit-report.txt
87+
exit 1
88+
89+
- name: Check for high vulnerabilities
90+
if: steps.yarn-audit.outputs.high != '0'
91+
run: |
92+
echo "::warning::Found ${{ steps.yarn-audit.outputs.high }} high severity vulnerabilities!"
93+
echo "Please review the audit results and plan updates for vulnerable dependencies."
94+
cat audit-report.txt
95+
96+
- name: Comment on PR
97+
if: github.event_name == 'pull_request'
98+
uses: actions/github-script@v7
99+
with:
100+
script: |
101+
const fs = require('fs');
102+
const auditResults = JSON.parse(fs.readFileSync('audit-results.json', 'utf8'));
103+
const vulns = auditResults.metadata.vulnerabilities;
104+
105+
const critical = vulns.critical || 0;
106+
const high = vulns.high || 0;
107+
const moderate = vulns.moderate || 0;
108+
const low = vulns.low || 0;
109+
110+
let status = '✅ No vulnerabilities found';
111+
let emoji = '✅';
112+
113+
if (critical > 0) {
114+
status = `🔴 ${critical} critical vulnerabilities found`;
115+
emoji = '🔴';
116+
} else if (high > 0) {
117+
status = `🟠 ${high} high severity vulnerabilities found`;
118+
emoji = '🟠';
119+
} else if (moderate > 0) {
120+
status = `🟡 ${moderate} moderate vulnerabilities found`;
121+
emoji = '🟡';
122+
} else if (low > 0) {
123+
status = `🟢 ${low} low severity vulnerabilities found`;
124+
emoji = '🟢';
125+
}
126+
127+
const comment = `## ${emoji} Dependency Security Audit
128+
129+
${status}
130+
131+
| Severity | Count |
132+
|----------|-------|
133+
| 🔴 Critical | ${critical} |
134+
| 🟠 High | ${high} |
135+
| 🟡 Moderate | ${moderate} |
136+
| 🟢 Low | ${low} |
137+
138+
${critical > 0 ? '⚠️ **Action Required:** Critical vulnerabilities must be resolved before merging.' : ''}
139+
${high > 0 ? '⚠️ **Recommended:** High severity vulnerabilities should be addressed.' : ''}
140+
141+
<details>
142+
<summary>View full audit report</summary>
143+
144+
\`\`\`
145+
${fs.readFileSync('audit-report.txt', 'utf8').slice(0, 5000)}
146+
\`\`\`
147+
148+
</details>
149+
`;
150+
151+
github.rest.issues.createComment({
152+
issue_number: context.issue.number,
153+
owner: context.repo.owner,
154+
repo: context.repo.repo,
155+
body: comment
156+
});
157+
158+
dependency-review:
159+
name: Dependency Review
160+
runs-on: ubuntu-latest
161+
if: github.event_name == 'pull_request'
162+
163+
steps:
164+
- name: Checkout repository
165+
uses: actions/checkout@v4
166+
167+
- name: Dependency Review
168+
uses: actions/dependency-review-action@v4
169+
with:
170+
fail-on-severity: high
171+
comment-summary-in-pr: true

‎electron/src/lib/openGraph.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,8 @@ import {config} from '../settings/config';
3131

3232
const logger = getLogger(path.basename(__filename));
3333

34-
axios.defaults.adapter = require('axios/lib/adapters/http'); // always use Node.js adapter
34+
// In axios 1.x, the http adapter is used by default in Node.js environment
35+
// No need to explicitly set it anymore
3536

3637
const arrayify = <T>(value: T[] | T = []): T[] => (Array.isArray(value) ? value : [value]);
3738

‎package.json‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
{
22
"author": "Wire Swiss <[email protected]>",
3+
"resolutions": {
4+
"form-data": ">=2.5.4"
5+
},
36
"dependencies": {
47
"@hapi/joi": "17.1.1",
58
"@wireapp/certificate-check": "0.7.20",
@@ -8,7 +11,7 @@
811
"@wireapp/react-ui-kit": "9.59.1",
912
"@wireapp/webapp-events": "0.28.1",
1013
"auto-launch": "5.0.6",
11-
"axios": "0.21.2",
14+
"axios": "1.12.2",
1215
"content-type": "1.0.5",
1316
"electron-dl": "^3.5.2",
1417
"electron-window-state": "5.0.3",
@@ -115,7 +118,7 @@
115118
"jest": "29.7.0",
116119
"jest-environment-jsdom": "29.7.0",
117120
"lint-staged": "15.5.2",
118-
"mocha": "10.8.2",
121+
"mocha": "^10.8.2",
119122
"nock": "13.5.6",
120123
"nyc": "15.1.0",
121124
"prettier": "2.8.8",

‎yarn.lock‎

Lines changed: 36 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -5221,15 +5221,6 @@ __metadata:
52215221
languageName: node
52225222
linkType: hard
52235223

5224-
"axios@npm:0.21.2":
5225-
version: 0.21.2
5226-
resolution: "axios@npm:0.21.2"
5227-
dependencies:
5228-
follow-redirects: ^1.14.0
5229-
checksum: 41299c21f77323e7c56ea49d2d5ed25407d24bb145a4ce3441a8db17359ae56554f9495dca6e15d343a9530e106212a684c75a4db3bedfbe19f6414a8d94378e
5230-
languageName: node
5231-
linkType: hard
5232-
52335224
"axios@npm:1.12.2":
52345225
version: 1.12.2
52355226
resolution: "axios@npm:1.12.2"
@@ -6099,7 +6090,7 @@ __metadata:
60996090
languageName: node
61006091
linkType: hard
61016092

6102-
"combined-stream@npm:^1.0.6, combined-stream@npm:^1.0.8, combined-stream@npm:~1.0.6":
6093+
"combined-stream@npm:^1.0.8, combined-stream@npm:~1.0.6":
61036094
version: 1.0.8
61046095
resolution: "combined-stream@npm:1.0.8"
61056096
dependencies:
@@ -8649,7 +8640,7 @@ __metadata:
86498640
languageName: node
86508641
linkType: hard
86518642

8652-
"follow-redirects@npm:^1.14.0, follow-redirects@npm:^1.15.6":
8643+
"follow-redirects@npm:^1.15.6":
86538644
version: 1.15.11
86548645
resolution: "follow-redirects@npm:1.15.11"
86558646
peerDependenciesMeta:
@@ -8695,7 +8686,7 @@ __metadata:
86958686
languageName: node
86968687
linkType: hard
86978688

8698-
"form-data@npm:4.0.4, form-data@npm:^4.0.0, form-data@npm:^4.0.4":
8689+
"form-data@npm:>=2.5.4":
86998690
version: 4.0.4
87008691
resolution: "form-data@npm:4.0.4"
87018692
dependencies:
@@ -8708,17 +8699,6 @@ __metadata:
87088699
languageName: node
87098700
linkType: hard
87108701

8711-
"form-data@npm:~2.3.2":
8712-
version: 2.3.3
8713-
resolution: "form-data@npm:2.3.3"
8714-
dependencies:
8715-
asynckit: ^0.4.0
8716-
combined-stream: ^1.0.6
8717-
mime-types: ^2.1.12
8718-
checksum: 10c1780fa13dbe1ff3100114c2ce1f9307f8be10b14bf16e103815356ff567b6be39d70fc4a40f8990b9660012dc24b0f5e1dde1b6426166eb23a445ba068ca3
8719-
languageName: node
8720-
linkType: hard
8721-
87228702
"fromentries@npm:^1.2.0":
87238703
version: 1.3.2
87248704
resolution: "fromentries@npm:1.3.2"
@@ -12054,37 +12034,6 @@ __metadata:
1205412034
languageName: node
1205512035
linkType: hard
1205612036

12057-
"mocha@npm:10.8.2":
12058-
version: 10.8.2
12059-
resolution: "mocha@npm:10.8.2"
12060-
dependencies:
12061-
ansi-colors: ^4.1.3
12062-
browser-stdout: ^1.3.1
12063-
chokidar: ^3.5.3
12064-
debug: ^4.3.5
12065-
diff: ^5.2.0
12066-
escape-string-regexp: ^4.0.0
12067-
find-up: ^5.0.0
12068-
glob: ^8.1.0
12069-
he: ^1.2.0
12070-
js-yaml: ^4.1.0
12071-
log-symbols: ^4.1.0
12072-
minimatch: ^5.1.6
12073-
ms: ^2.1.3
12074-
serialize-javascript: ^6.0.2
12075-
strip-json-comments: ^3.1.1
12076-
supports-color: ^8.1.1
12077-
workerpool: ^6.5.1
12078-
yargs: ^16.2.0
12079-
yargs-parser: ^20.2.9
12080-
yargs-unparser: ^2.0.0
12081-
bin:
12082-
_mocha: bin/_mocha
12083-
mocha: bin/mocha.js
12084-
checksum: 68cb519503f1e8ffd9b0651e1aef75dfe4754425186756b21e53169da44b5bcb1889e2b743711205082763d3f9a42eb8eb2c13bb1a718a08cb3a5f563bfcacdc
12085-
languageName: node
12086-
linkType: hard
12087-
1208812037
"mocha@npm:=10.4.0":
1208912038
version: 10.4.0
1209012039
resolution: "mocha@npm:10.4.0"
@@ -12116,6 +12065,37 @@ __metadata:
1211612065
languageName: node
1211712066
linkType: hard
1211812067

12068+
"mocha@npm:^10.8.2":
12069+
version: 10.8.2
12070+
resolution: "mocha@npm:10.8.2"
12071+
dependencies:
12072+
ansi-colors: ^4.1.3
12073+
browser-stdout: ^1.3.1
12074+
chokidar: ^3.5.3
12075+
debug: ^4.3.5
12076+
diff: ^5.2.0
12077+
escape-string-regexp: ^4.0.0
12078+
find-up: ^5.0.0
12079+
glob: ^8.1.0
12080+
he: ^1.2.0
12081+
js-yaml: ^4.1.0
12082+
log-symbols: ^4.1.0
12083+
minimatch: ^5.1.6
12084+
ms: ^2.1.3
12085+
serialize-javascript: ^6.0.2
12086+
strip-json-comments: ^3.1.1
12087+
supports-color: ^8.1.1
12088+
workerpool: ^6.5.1
12089+
yargs: ^16.2.0
12090+
yargs-parser: ^20.2.9
12091+
yargs-unparser: ^2.0.0
12092+
bin:
12093+
_mocha: bin/_mocha
12094+
mocha: bin/mocha.js
12095+
checksum: 68cb519503f1e8ffd9b0651e1aef75dfe4754425186756b21e53169da44b5bcb1889e2b743711205082763d3f9a42eb8eb2c13bb1a718a08cb3a5f563bfcacdc
12096+
languageName: node
12097+
linkType: hard
12098+
1211912099
"modify-filename@npm:^1.1.0":
1212012100
version: 1.1.0
1212112101
resolution: "modify-filename@npm:1.1.0"
@@ -16391,7 +16371,7 @@ __metadata:
1639116371
adm-zip: 0.5.16
1639216372
auto-launch: 5.0.6
1639316373
aws-sdk: 2.1692.0
16394-
axios: 0.21.2
16374+
axios: 1.12.2
1639516375
babel-core: 7.0.0-bridge.0
1639616376
babel-eslint: 10.1.0
1639716377
babel-jest: 29.7.0
@@ -16445,7 +16425,7 @@ __metadata:
1644516425
lodash: 4.17.21
1644616426
logdown: 3.3.1
1644716427
minimist: 1.2.8
16448-
mocha: 10.8.2
16428+
mocha: ^10.8.2
1644916429
nock: 13.5.6
1645016430
nyc: 15.1.0
1645116431
open-graph: 0.2.6

0 commit comments

Comments
 (0)