ben.carrasco/prowler
1
0 Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-10-21 19:04:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ui): remediate uuid security findings

Browse Source
This commit is contained in:
Alan Buscaglia committed 2026-05-22 14:04:18 +02:00
1 parent 2381899ea4
commit 6030ab46b4
4 files changed
+25 -16
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ui/components/resources/table/resource-detail-content.test.ts
+1 -1
View File
@@ -30,7 +30,7 @@ describe("resource detail content", () => {
it("renders the external resource link below the resource title row", () => {
expect(source).toContain(`</div>
<ExternalResourceLink`);
expect(source).toContain('className="self-start justify-start"');
expect(source).toContain('className="justify-start self-start"');
});
it("keeps resource date fields together on the third details row", () => {
ui/package.json
+3
View File
@@ -168,10 +168,13 @@
"@hono/node-server": "1.19.14",
"@internationalized/date": "3.10.0",
"@isaacs/brace-expansion": "5.0.1",
"@langchain/langgraph-checkpoint>uuid": "11.1.1",
"@langchain/langgraph>uuid": "11.1.1",
"@react-aria/interactions>react": "19.2.6",
"@react-aria/ssr>react": "19.2.6",
"@react-aria/ssr>react-dom": "19.2.6",
"@react-aria/visually-hidden>react": "19.2.6",
"@sentry/webpack-plugin>uuid": "11.1.1",
"fast-xml-parser": "5.8.0",
"hono": "4.12.18",
"lodash": "4.18.1",
ui/pnpm-lock.yaml
Generated
+13 -14
View File
@@ -20,6 +20,9 @@ overrides:
minimatch@>=10: 10.2.3
minimatch@<4: 3.1.4
qs: 6.14.2
'@langchain/langgraph-checkpoint>uuid': 11.1.1
'@langchain/langgraph>uuid': 11.1.1
'@sentry/webpack-plugin>uuid': 11.1.1
rollup@>=4: 4.59.0
serialize-javascript: 7.0.5
@@ -4188,6 +4191,7 @@ packages:
'@smithy/core@3.24.1':
resolution: {integrity: sha512-3mT7o4qQyUWttYnVK3A0Z/u3Xha3E81tXn32Tz6vjZiUXhBrkEivpw1hBYfh84iFF9CSzkBU9Y1DJ3Q6RQ231g==}
engines: {node: '>=18.0.0'}
deprecated: Deprecated due to bug in browser bundling instructions https://github.com/smithy-lang/smithy-typescript/issues/2025
'@smithy/credential-provider-imds@4.3.1':
resolution: {integrity: sha512-0S/acwHnqX4WrjXzhdiDRxsG2s9SC0cpPIK9nZ1R6UOHd+j7uL28+4bHu22urbLk2TVw3fkp6na/+fkUt/pLNQ==}
@@ -4788,6 +4792,7 @@ packages:
'@ungap/structured-clone@1.3.0':
resolution: {integrity: sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==}
deprecated: Potential CWE-502 - Update to 1.3.1 or higher
'@upsetjs/venn.js@2.0.0':
resolution: {integrity: sha512-WbBhLrooyePuQ1VZxrJjtLvTc4NVfpOyKx0sKqioq9bX1C1m7Jgykkn8gLrtwumBioXIqam8DLxp88Adbue6Hw==}
@@ -6053,6 +6058,7 @@ packages:
glob@10.5.0:
resolution: {integrity: sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==}
deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
hasBin: true
globals@14.0.0:
@@ -8273,19 +8279,14 @@ packages:
util-deprecate@1.0.2:
resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
uuid@10.0.0:
resolution: {integrity: sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==}
deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).
uuid@11.1.1:
resolution: {integrity: sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==}
hasBin: true
uuid@13.0.2:
resolution: {integrity: sha512-vzi9uRZ926x4XV73S/4qQaTwPXM2JBj6/6lI/byHH1jOpCzb0zDbfytgA9LcN/hzb2l7WQSQnxITOVx5un/wGw==}
hasBin: true
uuid@9.0.1:
resolution: {integrity: sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==}
hasBin: true
vary@1.1.2:
resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==}
engines: {node: '>= 0.8'}
@@ -10958,7 +10959,7 @@ snapshots:
'@langchain/langgraph-checkpoint@1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))':
dependencies:
'@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
uuid: 10.0.0
uuid: 11.1.1
'@langchain/langgraph-sdk@1.9.2(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)':
dependencies:
@@ -10985,7 +10986,7 @@ snapshots:
'@langchain/langgraph-sdk': 1.9.2(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)
'@langchain/protocol': 0.0.15
'@standard-schema/spec': 1.1.0
uuid: 10.0.0
uuid: 11.1.1
zod: 4.4.3
optionalDependencies:
zod-to-json-schema: 3.25.1(zod@4.4.3)
@@ -13516,7 +13517,7 @@ snapshots:
dependencies:
'@sentry/bundler-plugin-core': 4.7.0
unplugin: 1.0.1
uuid: 9.0.1
uuid: 11.1.1
webpack: 5.104.1(lightningcss@1.30.2)(postcss@8.5.14)
transitivePeerDependencies:
- encoding
@@ -16704,7 +16705,7 @@ snapshots:
roughjs: 4.6.6
stylis: 4.3.6
ts-dedent: 2.2.0
uuid: 13.0.2
uuid: 11.1.1
micromark-core-commonmark@2.0.3:
dependencies:
@@ -18454,12 +18455,10 @@ snapshots:
util-deprecate@1.0.2: {}
uuid@10.0.0: {}
uuid@11.1.1: {}
uuid@13.0.2: {}
uuid@9.0.1: {}
vary@1.1.2: {}
vaul@1.1.2(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
ui/pnpm-workspace.yaml
+8 -1
View File
@@ -33,7 +33,14 @@ allowBuilds:
# --- Level 3: Trust Policy + Exotic Subdeps ---
# Fail when a package's trust evidence is downgraded (e.g., new publisher).
trustPolicy: no-downgrade
trustPolicyExclude: []
trustPolicyExclude:
# next-auth: real beta releases currently do not publish provenance, while an
# earlier one-off manual test release did. Keep this scoped to the exact
# reviewed version so a bump fails until re-reviewed.
- "next-auth@5.0.0-beta.30"
# semver: legacy 6.x releases predate modern npm provenance. Keep this scoped
# to the exact transitive version so a bump fails until re-reviewed.
- "semver@6.3.1"
# Block transitive dependencies from using exotic specifiers (git URLs, tarballs).
blockExoticSubdeps: true