npm dependent vulnerabilities in .github/contributors/package-lock.json

[sebastien-rosset]

Welcome

• Yes, I'm using a binary release within 2 latest major releases. Only such installations are supported.
• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've included all information below (version, config, etc).
• Yes, I've tried with the standalone linter if available. (https://golangci-lint.run/usage/linters/)

Description of the problem

The file .github/contributors/package-lock.json (which is created by npm) has versions of modules that have known security vulnerabilities.

This is how I found the problem:

1. Created a fork of golangci/golangci-lint at https://github.com/CiscoM31/golangci-lint. Make sure the fork is in sync with upstream master.
2. Noticed the github banner message: "We found potential security vulnerabilities in your dependencies."
3. Clicked "enable dependabot" to see dependabot alerts. In the "Security" tab, a new "Dependabot alerts" item is added: https://github.com/CiscoM31/golangci-lint/security/dependabot.
   1. "Get notified when one of your dependencies has a vulnerability".
   2. I've noticed this item is not present in the upstream project "golangci/golangci-lint".
4. In the fork "Dependabot alerts" shows 11 security alerts.

Maybe I am missing something, but it looks like the same issues are impacting the main project golangci/golangci-lint. npm is created by .github/contributors/package-lock.json and I'm not sure how golangci/golangci-lint uses these dependencies.

It would be good to setup a security policy to provide information on how to report security vulnerabilities.

Version of golangci-lint

$ golangci-lint --version
# Not applicable

Configuration file

$ cat .golangci.yml
# Not applicable

Go environment

$ go version && go env
# Not applicable

Verbose output of running

$ golangci-lint cache clean
$ golangci-lint run -v
# Not applicable

Code example or link to a public repository

// not applicable

[sebastien-rosset]

There are two high vulnerabilities:

1 trim-newlines vulnerability found in …/contributors/package-lock.json on Jul 29
Remediation
Upgrade trim-newlines to version 3.0.1 or later. For example:

CVE-2021-33623
high severity
Vulnerable versions: < 3.0.1
Patched version: 3.0.1
The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

1 set-value vulnerability found in …/peril/package-lock.json on Sep 17

CVE-2021-23440
high severity
Vulnerable versions: < 4.0.1
Patched version: 4.0.1
This affects the package set-value before 4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.