<div dir="ltr">Done. <div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><pre style="color:rgb(46,52,54);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px">-- </pre><div style="color:rgb(46,52,54);font-size:14.6667px;font-style:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;width:71ch">Ibiam Chihurumnaya</div><div style="color:rgb(46,52,54);font-size:14.6667px;font-style:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;width:71ch"><a href="mailto:ibiam@sugarlabs.org" target="_blank">ibiam@sugarlabs.org</a> </div> </div></div></div> </div></div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jul 13, 2021 at 8:58 PM Bernie Innocenti <<a href="mailto:bernie@codewiz.org">bernie@codewiz.org</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I'm seeing a high-severity security bug in the version of grunt that we're using for the website. Could someone please upgrade? -------- Forwarded Message -------- Subject: [GitHub] Your Dependabot alerts for the week of Jul 6 - Jul 13 Date: Tue, 13 Jul 2021 16:46:56 +0000 (UTC) From: GitHub <<a href="mailto:noreply@github.com" target="_blank">noreply@github.com</a>> To: Bernie Innocenti <<a href="mailto:bernie@codewiz.org" target="_blank">bernie@codewiz.org</a>> Dependabot alerts on GitHub Explore this week on GitHub Dependabot alerts GitHub <<a href="https://github.com" rel="noreferrer" target="_blank">https://github.com</a>> security alert digest *codewiz’s* repository security updates from the week of *Jul 6 - Jul 13* <<a href="https://github.com/sugarlabs" rel="noreferrer" target="_blank">https://github.com/sugarlabs</a>> Sugar Labs organization <<a href="https://github.com/sugarlabs" rel="noreferrer" target="_blank">https://github.com/sugarlabs</a>> Warning! sugarlabs / *sugar-web* <<a href="https://github.com/sugarlabs/sugar-web" rel="noreferrer" target="_blank">https://github.com/sugarlabs/sugar-web</a>> Known security vulnerabilities detected Dependency grunt Version < 1.3.0 Upgrade to ~> 1.3.0 Defined in package.json Vulnerabilities CVE-2020-7729 High severity Review all vulnerable dependencies <<a href="https://github.com/sugarlabs/sugar-web/security/dependabot" rel="noreferrer" target="_blank">https://github.com/sugarlabs/sugar-web/security/dependabot</a>> Warning! sugarlabs / *sugar-gitbot* <<a href="https://github.com/sugarlabs/sugar-gitbot" rel="noreferrer" target="_blank">https://github.com/sugarlabs/sugar-gitbot</a>> Known security vulnerabilities detected Dependency express Version < 3.11.0 Upgrade to ~> 3.11.0 Defined in package.json Vulnerabilities CVE-2014-6393 Moderate severity Review all vulnerable dependencies <<a href="https://github.com/sugarlabs/sugar-gitbot/security/dependabot" rel="noreferrer" target="_blank">https://github.com/sugarlabs/sugar-gitbot/security/dependabot</a>> Warning! sugarlabs / *www-sugarlabs* <<a href="https://github.com/sugarlabs/www-sugarlabs" rel="noreferrer" target="_blank">https://github.com/sugarlabs/www-sugarlabs</a>> Known security vulnerabilities detected Dependency kramdown Version < 2.3.0 Upgrade to ~> 2.3.0 Defined in Gemfile.lock Vulnerabilities CVE-2020-14001 High severity CVE-2021-28834 High severity Dependency nokogiri Version < 1.11.4 Upgrade to ~> 1.11.4 Defined in Gemfile.lock Suggested update #334 <<a href="https://github.com/sugarlabs/www-sugarlabs/pull/334" rel="noreferrer" target="_blank">https://github.com/sugarlabs/www-sugarlabs/pull/334</a>> Vulnerabilities GHSA-7rrm-v45f-jp64 Moderate severity Dependency addressable Version > 2.3.0 <= 2.7.0 Upgrade to ~> 2.8.0 Defined in Gemfile.lock Vulnerabilities CVE-2021-32740 High severity Review all vulnerable dependencies <<a href="https://github.com/sugarlabs/www-sugarlabs/security/dependabot" rel="noreferrer" target="_blank">https://github.com/sugarlabs/www-sugarlabs/security/dependabot</a>> Warning! sugarlabs / *musicblocks* <<a href="https://github.com/sugarlabs/musicblocks" rel="noreferrer" target="_blank">https://github.com/sugarlabs/musicblocks</a>> Known security vulnerabilities detected Dependency is-svg Version >= 2.1.0 < 4.2.2 Upgrade to ~> 4.2.2 Defined in package-lock.json Vulnerabilities CVE-2021-28092 High severity Dependency hosted-git-info Version < 2.8.9 Upgrade to ~> 2.8.9 Defined in package-lock.json Suggested update #2945 <<a href="https://github.com/sugarlabs/musicblocks/pull/2945" rel="noreferrer" target="_blank">https://github.com/sugarlabs/musicblocks/pull/2945</a>> Vulnerabilities CVE-2021-23362 Moderate severity Dependency trim-newlines Version < 3.0.1 Upgrade to ~> 3.0.1 Defined in package-lock.json Vulnerabilities CVE-2021-33623 High severity Dependency glob-parent Version < 5.1.2 Upgrade to ~> 5.1.2 Defined in package-lock.json Vulnerabilities CVE-2020-28469 High severity Dependency postcss Version >= 7.0.0 < 7.0.36 Upgrade to ~> 7.0.36 Defined in package-lock.json Suggested update #2964 <<a href="https://github.com/sugarlabs/musicblocks/pull/2964" rel="noreferrer" target="_blank">https://github.com/sugarlabs/musicblocks/pull/2964</a>> Vulnerabilities CVE-2021-23368 Moderate severity Dependency color-string Version < 1.5.5 Upgrade to ~> 1.5.5 Defined in package-lock.json Suggested update #2967 <<a href="https://github.com/sugarlabs/musicblocks/pull/2967" rel="noreferrer" target="_blank">https://github.com/sugarlabs/musicblocks/pull/2967</a>> Vulnerabilities CVE-2021-29060 Moderate severity Review all vulnerable dependencies <<a href="https://github.com/sugarlabs/musicblocks/security/dependabot" rel="noreferrer" target="_blank">https://github.com/sugarlabs/musicblocks/security/dependabot</a>> Warning! sugarlabs / *edit-fonts-activity* <<a href="https://github.com/sugarlabs/edit-fonts-activity" rel="noreferrer" target="_blank">https://github.com/sugarlabs/edit-fonts-activity</a>> Known security vulnerabilities detected Dependency underscore Version >= 1.3.2 < 1.12.1 Upgrade to ~> 1.12.1 Defined in underscore.js Vulnerabilities CVE-2021-23358 High severity Review all vulnerable dependencies <<a href="https://github.com/sugarlabs/edit-fonts-activity/security/dependabot" rel="noreferrer" target="_blank">https://github.com/sugarlabs/edit-fonts-activity/security/dependabot</a>> Warning! sugarlabs / *aventura-matematica-activity* <<a href="https://github.com/sugarlabs/aventura-matematica-activity" rel="noreferrer" target="_blank">https://github.com/sugarlabs/aventura-matematica-activity</a>> Known security vulnerabilities detected Dependency grunt Version < 1.3.0 Upgrade to ~> 1.3.0 Defined in package.json Vulnerabilities CVE-2020-7729 High severity Review all vulnerable dependencies <<a href="https://github.com/sugarlabs/aventura-matematica-activity/security/dependabot" rel="noreferrer" target="_blank">https://github.com/sugarlabs/aventura-matematica-activity/security/dependabot</a>> Warning! sugarlabs / *diamond-fusion-activity* <<a href="https://github.com/sugarlabs/diamond-fusion-activity" rel="noreferrer" target="_blank">https://github.com/sugarlabs/diamond-fusion-activity</a>> Known security vulnerabilities detected Dependency grunt Version < 1.3.0 Upgrade to ~> 1.3.0 Defined in package.json Vulnerabilities CVE-2020-7729 High severity Review all vulnerable dependencies <<a href="https://github.com/sugarlabs/diamond-fusion-activity/security/dependabot" rel="noreferrer" target="_blank">https://github.com/sugarlabs/diamond-fusion-activity/security/dependabot</a>> Warning! sugarlabs / *hfoss-sugar-snake* <<a href="https://github.com/sugarlabs/hfoss-sugar-snake" rel="noreferrer" target="_blank">https://github.com/sugarlabs/hfoss-sugar-snake</a>> Known security vulnerabilities detected Dependency <a href="http://socket.io" rel="noreferrer" target="_blank">socket.io</a> Version < 2.4.0 Upgrade to ~> 2.4.0 Defined in package.json Vulnerabilities CVE-2020-28481 Moderate severity Review all vulnerable dependencies <<a href="https://github.com/sugarlabs/hfoss-sugar-snake/security/dependabot" rel="noreferrer" target="_blank">https://github.com/sugarlabs/hfoss-sugar-snake/security/dependabot</a>> <<a href="https://github.com/sugarlabs-infra" rel="noreferrer" target="_blank">https://github.com/sugarlabs-infra</a>> sugarlabs-infra organization <<a href="https://github.com/sugarlabs-infra" rel="noreferrer" target="_blank">https://github.com/sugarlabs-infra</a>> Warning! sugarlabs-infra / *helios-server* <<a href="https://github.com/sugarlabs-infra/helios-server" rel="noreferrer" target="_blank">https://github.com/sugarlabs-infra/helios-server</a>> Known security vulnerabilities detected Dependency gunicorn Version < 19.5.0 Upgrade to ~> 19.5.0 Defined in requirements.txt Vulnerabilities CVE-2018-1000164 Moderate severity Dependency requests Version <= 2.19.1 Upgrade to ~> 2.20.0 Defined in requirements.txt Vulnerabilities CVE-2018-18074 Moderate severity Dependency django Version < 1.11.18 Upgrade to ~> 1.11.18 Defined in requirements.txt Vulnerabilities CVE-2020-9402 High severity CVE-2021-33203 High severity CVE-2019-3498 Low severity CVE-2019-6975 Moderate severity CVE-2019-19844 Moderate severity View 1 more <<a href="https://github.com/sugarlabs-infra/helios-server/security/dependabot/requirements.txt/django/open" rel="noreferrer" target="_blank">https://github.com/sugarlabs-infra/helios-server/security/dependabot/requirements.txt/django/open</a>> Dependency bleach Version < 3.1.1 Upgrade to ~> 3.1.1 Defined in requirements.txt Vulnerabilities CVE-2020-6802 Moderate severity CVE-2020-6816 Moderate severity CVE-2020-6817 Moderate severity CVE-2021-23980 Moderate severity Review all vulnerable dependencies <<a href="https://github.com/sugarlabs-infra/helios-server/security/dependabot" rel="noreferrer" target="_blank">https://github.com/sugarlabs-infra/helios-server/security/dependabot</a>> Always verify the validity and compatibility of suggestions with your codebase. ------------------------------------------------------------------------ Change how you receive security alert emails in your notification preferences <<a href="https://github.com/settings/notifications#vulnerability-alerts-heading" rel="noreferrer" target="_blank">https://github.com/settings/notifications#vulnerability-alerts-heading</a>>. Unsubscribe <<a href="https://github.com/email/unsubscribe?token=AAJBF3DVGSNEPYLTJTEDVKLCZ33QBANENZQW2ZNNOZ2WY3TFOJQWE2LMNF2HS" rel="noreferrer" target="_blank">https://github.com/email/unsubscribe?token=AAJBF3DVGSNEPYLTJTEDVKLCZ33QBANENZQW2ZNNOZ2WY3TFOJQWE2LMNF2HS</a>> · Email preferences <<a href="https://github.com/settings/emails" rel="noreferrer" target="_blank">https://github.com/settings/emails</a>> · Terms <<a href="https://docs.github.com/articles/github-terms-of-service" rel="noreferrer" target="_blank">https://docs.github.com/articles/github-terms-of-service</a>> · Privacy <<a href="https://docs.github.com/articles/github-privacy-policy" rel="noreferrer" target="_blank">https://docs.github.com/articles/github-privacy-policy</a>> · Sign into GitHub <<a href="https://github.com/login" rel="noreferrer" target="_blank">https://github.com/login</a>> GitHub, Inc. 88 Colin P Kelly Jr St. San Francisco, CA 94107 _______________________________________________ Systems mailing list <a href="mailto:Systems@lists.sugarlabs.org" target="_blank">Systems@lists.sugarlabs.org</a> <a href="http://lists.sugarlabs.org/listinfo/systems" rel="noreferrer" target="_blank">http://lists.sugarlabs.org/listinfo/systems</a> </blockquote></div>