lighthouse 9.5.0-dev.20220814 → 9.5.0-dev.20220817

package/core/audits/dobetterweb/no-vulnerable-libraries.js

@@ -1,229 +0,0 @@
-/**
- * @license Copyright 2017 The Lighthouse Authors. All Rights Reserved.
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
- */
-
-/**
- * @fileoverview Audits a page to make sure there are no JS libraries with
- * known vulnerabilities being used. Checks against a vulnerability db
- * provided by Snyk.io and checked in locally as third-party/snyk/snapshot.json
- */
-
-'use strict';
-
-import fs from 'fs';
-import {Audit} from '../audit.js';
-import {Sentry} from '../../lib/sentry.js';
-import semver from 'semver';
-import * as i18n from '../../lib/i18n/i18n.js';
-import {LH_ROOT} from '../../../root.js';
-
-const snykDatabase = JSON.parse(
-  fs.readFileSync(`${LH_ROOT}/third-party/snyk/snapshot.json`, 'utf-8'));
-
-const UIStrings = {
-  /** Title of a Lighthouse audit that provides detail on Javascript libraries the page uses. This descriptive title is shown to users when all Javascript libraries are free of known security vulnerabilities. */
-  title: 'Avoids front-end JavaScript libraries' +
-    ' with known security vulnerabilities',
-  /** Title of a Lighthouse audit that provides detail on Javascript libraries the page uses. This descriptive title is shown to users when some detected Javascript libraries have known security vulnerabilities. */
-  failureTitle: 'Includes front-end JavaScript libraries' +
-    ' with known security vulnerabilities',
-  /** Description of a Lighthouse audit that tells the user why they should be concerned about the third party Javascript libraries that they use. This is displayed after a user expands the section to see more. No character length limits. 'Learn More' becomes link text to additional documentation. */
-  description: 'Some third-party scripts may contain known security vulnerabilities ' +
-    'that are easily identified and exploited by attackers. ' +
-    '[Learn more about vulnerable libraries](https://web.dev/no-vulnerable-libraries/).',
-  /** [ICU Syntax] Label for the audit identifying the number of vulnerable Javascript libraries found. */
-  displayValue: `{itemCount, plural,
-    =1 {1 vulnerability detected}
-    other {# vulnerabilities detected}
-    }`,
-  /** Label for a column in a data table; entries will be the version numbers of the Javascript libraries found.  */
-  columnVersion: 'Library Version',
-  /** Label for a column in a data table; entries will be the counts of JavaScript-library vulnerabilities found.  */
-  columnVuln: 'Vulnerability Count',
-  /** Label for a column in a data table; entries will be the severity of the vulnerabilities found within a Javascript library. */
-  columnSeverity: 'Highest Severity',
-};
-
-const str_ = i18n.createIcuMessageFn(import.meta.url, UIStrings);
-
-const SEMVER_REGEX = /^(\d+\.\d+\.\d+)[^-0-9]+/;
-
-/** @type {Record<string, LH.IcuMessage>} */
-const severityStringsMap = {
-  'low': str_(i18n.UIStrings.itemSeverityLow),
-  'medium': str_(i18n.UIStrings.itemSeverityMedium),
-  'high': str_(i18n.UIStrings.itemSeverityHigh),
-};
-
-/** @typedef {{npm: Object<string, Array<{id: string, severity: string, semver: {vulnerable: Array<string>}}>>}} SnykDB */
-/** @typedef {{severity: LH.IcuMessage, numericSeverity: number, library: string, url: string}} Vulnerability */
-
-class NoVulnerableLibrariesAudit extends Audit {
-  /**
-   * @return {LH.Audit.Meta}
-   */
-  static get meta() {
-    return {
-      id: 'no-vulnerable-libraries',
-      title: str_(UIStrings.title),
-      failureTitle: str_(UIStrings.failureTitle),
-      description: str_(UIStrings.description),
-      requiredArtifacts: ['Stacks'],
-    };
-  }
-
-  /**
-   * @return {SnykDB}
-   */
-  static get snykDB() {
-    return snykDatabase;
-  }
-
-  /**
-   * @return {Object<string, number>}
-   */
-  static get severityMap() {
-    return {
-      high: 3,
-      medium: 2,
-      low: 1,
-    };
-  }
-
-  /**
-   * Attempts to normalize the version.
-   * @param {string|undefined} version
-   * @return {string|undefined}
-   */
-  static normalizeVersion(version) {
-    if (!version) return version;
-    if (semver.valid(version)) return version;
-
-    // converts 1.5 -> 1.5.0
-    if (/^\d+\.\d+$/.test(version)) return `${version}.0`;
-    // converts 1.0.0a-bunch-of-crap -> 1.0.0
-    const versionMatch = version.match(SEMVER_REGEX);
-    if (versionMatch) return versionMatch[1];
-    // leave everything else untouched
-    return version;
-  }
-
-  /**
-   * @param {string} normalizedVersion
-   * @param {LH.Artifacts.DetectedStack} lib
-   * @param {SnykDB} snykDB
-   * @return {Array<Vulnerability>}
-   */
-  static getVulnerabilities(normalizedVersion, lib, snykDB) {
-    if (!lib.npm || !snykDB.npm[lib.npm]) {
-      return [];
-    }
-
-    // Verify the version is well-formed first
-    try {
-      semver.satisfies(normalizedVersion, '*');
-    } catch (err) {
-      err.pkgName = lib.npm;
-      // Report the failure and skip this library if the version was ill-specified
-      Sentry.captureException(err, {level: 'warning'});
-      return [];
-    }
-
-    // Match the vulnerability candidates from snyk against the version we see in the page
-    const vulnCandidatesForLib = snykDB.npm[lib.npm];
-    const matchingVulns = vulnCandidatesForLib.filter(vulnCandidate => {
-      // Each snyk vulnerability comes with an array of semver ranges
-      // The page is vulnerable if any of the ranges match.
-      const hasMatchingVersion = vulnCandidate.semver.vulnerable.some(vulnSemverRange =>
-        semver.satisfies(normalizedVersion, vulnSemverRange)
-      );
-      return hasMatchingVersion;
-    });
-
-    const vulns = matchingVulns.map(vuln => {
-      return {
-        severity: severityStringsMap[vuln.severity],
-        numericSeverity: this.severityMap[vuln.severity],
-        library: `${lib.name}@${normalizedVersion}`,
-        url: 'https://snyk.io/vuln/' + vuln.id,
-      };
-    });
-
-    return vulns;
-  }
-
-  /**
-   * @param {Array<Vulnerability>} vulnerabilities
-   * @return {LH.IcuMessage}
-   */
-  static highestSeverity(vulnerabilities) {
-    const sortedVulns = vulnerabilities
-      .sort((a, b) => b.numericSeverity - a.numericSeverity);
-    return sortedVulns[0].severity;
-  }
-
-  /**
-   * @param {LH.Artifacts} artifacts
-   * @return {LH.Audit.Product}
-   */
-  static audit(artifacts) {
-    const foundLibraries = artifacts.Stacks.filter(stack => stack.detector === 'js');
-    const snykDB = NoVulnerableLibrariesAudit.snykDB;
-
-    if (!foundLibraries.length) {
-      return {
-        score: 1,
-      };
-    }
-
-    let totalVulns = 0;
-    /** @type {Array<{highestSeverity: LH.IcuMessage, vulnCount: number, detectedLib: LH.Audit.Details.LinkValue}>} */
-    const vulnerabilityResults = [];
-
-    for (const lib of foundLibraries) {
-      const version = this.normalizeVersion(lib.version) || '';
-      const vulns = this.getVulnerabilities(version, lib, snykDB);
-      const vulnCount = vulns.length;
-      totalVulns += vulnCount;
-
-      let highestSeverity;
-      if (vulns.length > 0) {
-        highestSeverity = this.highestSeverity(vulns);
-
-        vulnerabilityResults.push({
-          highestSeverity,
-          vulnCount,
-          detectedLib: {
-            text: lib.name + '@' + version,
-            url: `https://snyk.io/vuln/npm:${lib.npm}?lh=${version}&utm_source=lighthouse&utm_medium=ref&utm_campaign=audit`,
-            type: 'link',
-          },
-        });
-      }
-    }
-
-    let displayValue;
-    if (totalVulns > 0) {
-      displayValue = str_(UIStrings.displayValue, {itemCount: totalVulns});
-    }
-
-    /** @type {LH.Audit.Details.Table['headings']} */
-    const headings = [
-      {key: 'detectedLib', itemType: 'link', text: str_(UIStrings.columnVersion)},
-      {key: 'vulnCount', itemType: 'text', text: str_(UIStrings.columnVuln)},
-      {key: 'highestSeverity', itemType: 'text', text: str_(UIStrings.columnSeverity)},
-    ];
-    const details = Audit.makeTableDetails(headings, vulnerabilityResults, {});
-
-    return {
-      score: Number(totalVulns === 0),
-      displayValue,
-      details,
-    };
-  }
-}
-
-export default NoVulnerableLibrariesAudit;
-export {UIStrings};

package/report/generator/package.json

@@ -1,4 +0,0 @@
-{
-  "type": "commonjs",
-  "//": "Preserve commonjs in this directory. Temporary file until converted to type: module"
-}

package/report/test/generator/package.json

@@ -1,4 +0,0 @@
-{
-  "type": "commonjs",
-  "//": "Preserve commonjs in this directory. Temporary file until converted to type: module"
-}

package/shared/package.json

@@ -1,4 +0,0 @@
-{
-  "type": "commonjs",
-  "//": "Preserve commonjs in this directory. Temporary file until converted to type: module"
-}

package/third-party/snyk/snapshot.json

@@ -1,182 +0,0 @@
-{
-  "npm":{
-    "@angular/core":[
-      {"id":"SNYK-JS-ANGULARCORE-1070902","severity":"low","semver":{"vulnerable":["<11.0.5",">=11.1.0-next.0 <11.1.0-next.3"]}}
-    ],
-    "angular":[
-      {"id":"SNYK-JS-ANGULAR-572020","severity":"high","semver":{"vulnerable":["<1.8.0"]}},
-      {"id":"SNYK-JS-ANGULAR-570058","severity":"medium","semver":{"vulnerable":["<1.8.0"]}},
-      {"id":"SNYK-JS-ANGULAR-534884","severity":"high","semver":{"vulnerable":[">=1.4.0-beta.6 <1.7.9"]}},
-      {"id":"SNYK-JS-ANGULAR-471885","severity":"medium","semver":{"vulnerable":["<1.6.3"]}},
-      {"id":"SNYK-JS-ANGULAR-471882","severity":"medium","semver":{"vulnerable":["<1.6.5"]}},
-      {"id":"SNYK-JS-ANGULAR-471879","severity":"medium","semver":{"vulnerable":["<1.6.0-rc.0"]}},
-      {"id":"npm:angular:20180202","severity":"medium","semver":{"vulnerable":["<1.6.9"]}},
-      {"id":"npm:angular:20171018","severity":"medium","semver":{"vulnerable":["<1.6.7"]}},
-      {"id":"npm:angular:20160527","severity":"medium","semver":{"vulnerable":[">=1.0.0 <1.2.30"]}},
-      {"id":"npm:angular:20160122","severity":"medium","semver":{"vulnerable":[">=1.3.0 <1.5.0-rc.2"]}},
-      {"id":"npm:angular:20140608","severity":"low","semver":{"vulnerable":["<1.3.0"]}},
-      {"id":"npm:angular:20131113","severity":"high","semver":{"vulnerable":["<1.2.2"]}},
-      {"id":"npm:angular:20140908","severity":"medium","semver":{"vulnerable":["<1.3.0-rc.5"]}},
-      {"id":"npm:angular:20161101","severity":"medium","semver":{"vulnerable":[">=1.5.0 <1.5.9"]}},
-      {"id":"npm:angular:20150909","severity":"high","semver":{"vulnerable":["<1.5.0-beta.2"]}},
-      {"id":"npm:angular:20151205","severity":"medium","semver":{"vulnerable":["<1.5.0-rc.0"]}},
-      {"id":"npm:angular:20151130","severity":"medium","semver":{"vulnerable":["<1.4.10"]}},
-      {"id":"npm:angular:20130622","severity":"medium","semver":{"vulnerable":[">=1.0.0 <1.2.0"]}},
-      {"id":"npm:angular:20150807-1","severity":"medium","semver":{"vulnerable":[">=1.3.1 <1.5.0-beta.0"]}},
-      {"id":"npm:angular:20150807","severity":"high","semver":{"vulnerable":[">=1.0.0 <1.5.0-beta.0"]}},
-      {"id":"npm:angular:20150315","severity":"medium","semver":{"vulnerable":["<1.6.1"]}},
-      {"id":"npm:angular:20150310","severity":"high","semver":{"vulnerable":["<1.4.0-beta.6"]}},
-      {"id":"npm:angular:20141104","severity":"medium","semver":{"vulnerable":["<1.3.2"]}},
-      {"id":"npm:angular:20130621","severity":"medium","semver":{"vulnerable":["<1.2.0"]}},
-      {"id":"npm:angular:20140909","severity":"high","semver":{"vulnerable":[">=1.2.19 <1.2.27"]}},
-      {"id":"npm:angular:20130625","severity":"high","semver":{"vulnerable":["<1.1.5"]}}
-    ],
-    "backbone":[
-      {"id":"npm:backbone:20160523","severity":"medium","semver":{"vulnerable":["<0.1.2"]}},
-      {"id":"npm:backbone:20110701","severity":"medium","semver":{"vulnerable":["<0.5.0"]}}
-    ],
-    "bootstrap":[
-      {"id":"SNYK-JS-BOOTSTRAP-173700","severity":"medium","semver":{"vulnerable":["<3.4.1",">=4.0.0 <4.3.1"]}},
-      {"id":"SNYK-JS-BOOTSTRAP-73560","severity":"medium","semver":{"vulnerable":[">=4.0.0 <4.1.2"]}},
-      {"id":"SNYK-JS-BOOTSTRAP-72890","severity":"medium","semver":{"vulnerable":["<3.4.0"]}},
-      {"id":"SNYK-JS-BOOTSTRAP-72889","severity":"medium","semver":{"vulnerable":["<3.4.0"]}},
-      {"id":"npm:bootstrap:20180529","severity":"medium","semver":{"vulnerable":["<3.4.0",">=4.0.0 <4.1.2"]}},
-      {"id":"npm:bootstrap:20160627","severity":"medium","semver":{"vulnerable":["<3.4.0",">=4.0.0-alpha <4.0.0-beta.2"]}},
-      {"id":"npm:bootstrap:20120510","severity":"medium","semver":{"vulnerable":["<2.1.0"]}}
-    ],
-    "dojo":[
-      {"id":"SNYK-JS-DOJO-1535223","severity":"high","semver":{"vulnerable":["<1.17.0"]}},
-      {"id":"SNYK-JS-DOJO-559224","severity":"medium","semver":{"vulnerable":["<1.11.10",">=1.12.1 <1.12.8",">=1.13.0 <1.13.7",">=1.14.0 <1.14.6",">=1.15.0 <1.15.3",">=1.16.0 <1.16.2"]}},
-      {"id":"SNYK-JS-DOJO-174934","severity":"medium","semver":{"vulnerable":[">=1.0.0 <1.0.3",">=1.1.0 <1.1.2",">=1.2.0 <1.2.4",">=1.3.0 <1.3.3",">=1.4.0 <1.4.2"]}},
-      {"id":"SNYK-JS-DOJO-174933","severity":"medium","semver":{"vulnerable":["<1.2.0"]}},
-      {"id":"SNYK-JS-DOJO-72305","severity":"medium","semver":{"vulnerable":[">=1.14.0-pre <1.14.0",">=1.13.0 <1.13.1",">=1.12.1 <1.12.4",">=1.11.0-rc1 <1.11.6","<1.10.10"]}},
-      {"id":"npm:dojo:20180818","severity":"medium","semver":{"vulnerable":["<1.10.10",">=1.11.0 <1.11.6",">=1.12.0 <1.12.4",">=1.13.0 <1.13.1"]}},
-      {"id":"npm:dojo:20100614-6","severity":"medium","semver":{"vulnerable":["<1.4.2"]}},
-      {"id":"npm:dojo:20100614","severity":"medium","semver":{"vulnerable":[">=0.4.0 <0.4.4",">=1.0.0 <1.0.3",">=1.1.0 <1.1.2",">=1.2.0 <1.2.4",">=1.3.0 <1.3.3",">=1.4.0 <1.4.2"]}}
-    ],
-    "foundation-sites":[
-      {"id":"npm:foundation-sites:20170802","severity":"medium","semver":{"vulnerable":["<6.0.0"]}},
-      {"id":"npm:foundation-sites:20150619","severity":"medium","semver":{"vulnerable":["<5.5.3"]}},
-      {"id":"npm:foundation-sites:20120717","severity":"medium","semver":{"vulnerable":[">=3.0.0 <3.0.6"]}}
-    ],
-    "google-closure-library":[
-      {"id":"SNYK-JS-GOOGLECLOSURELIBRARY-561341","severity":"medium","semver":{"vulnerable":["<20200315.0.0"]}},
-      {"id":"SNYK-JS-GOOGLECLOSURELIBRARY-174519","severity":"medium","semver":{"vulnerable":[">=20190121.0.0 <20190301.0.0"]}}
-    ],
-    "gsap":[
-      {"id":"SNYK-JS-GSAP-1054614","severity":"high","semver":{"vulnerable":["<3.6.0"]}}
-    ],
-    "handlebars":[
-      {"id":"SNYK-JS-HANDLEBARS-1279029","severity":"medium","semver":{"vulnerable":["<4.7.7"]}},
-      {"id":"SNYK-JS-HANDLEBARS-1056767","severity":"high","semver":{"vulnerable":["<4.7.7"]}},
-      {"id":"SNYK-JS-HANDLEBARS-567742","severity":"medium","semver":{"vulnerable":["<4.6.0"]}},
-      {"id":"SNYK-JS-HANDLEBARS-534988","severity":"critical","semver":{"vulnerable":[">=4.0.0 <4.5.3","<3.0.8"]}},
-      {"id":"SNYK-JS-HANDLEBARS-534478","severity":"high","semver":{"vulnerable":[">=4.0.0 <4.5.3","<3.0.8"]}},
-      {"id":"SNYK-JS-HANDLEBARS-480388","severity":"high","semver":{"vulnerable":[">=4.0.0 <4.4.5"]}},
-      {"id":"SNYK-JS-HANDLEBARS-469063","severity":"high","semver":{"vulnerable":[">=4.0.0 <4.3.0","<3.8.0"]}},
-      {"id":"SNYK-JS-HANDLEBARS-174183","severity":"high","semver":{"vulnerable":[">=3.0.0 <3.0.7",">=4.1.0 <4.1.2",">=4.0.0 <4.0.14"]}},
-      {"id":"SNYK-JS-HANDLEBARS-173692","severity":"high","semver":{"vulnerable":["<4.0.14",">=4.1.0 <4.1.2"]}},
-      {"id":"npm:handlebars:20151207","severity":"medium","semver":{"vulnerable":["<4.0.0"]}},
-      {"id":"npm:handlebars:20110425","severity":"medium","semver":{"vulnerable":["<=1.0.0-beta.3"]}}
-    ],
-    "highcharts":[
-      {"id":"SNYK-JS-HIGHCHARTS-1290057","severity":"medium","semver":{"vulnerable":["<9.0.0"]}},
-      {"id":"SNYK-JS-HIGHCHARTS-1018906","severity":"medium","semver":{"vulnerable":["<9.0.0"]}},
-      {"id":"SNYK-JS-HIGHCHARTS-571995","severity":"high","semver":{"vulnerable":["<7.2.2",">=8.0.0 <8.1.1"]}},
-      {"id":"npm:highcharts:20180225","severity":"high","semver":{"vulnerable":["<6.1.0"]}}
-    ],
-    "jquery":[
-      {"id":"SNYK-JS-JQUERY-569619","severity":"medium","semver":{"vulnerable":["<1.9.0"]}},
-      {"id":"SNYK-JS-JQUERY-567880","severity":"medium","semver":{"vulnerable":[">=1.2.0 <3.5.0"]}},
-      {"id":"SNYK-JS-JQUERY-565129","severity":"medium","semver":{"vulnerable":[">=1.5.1 <3.5.0"]}},
-      {"id":"SNYK-JS-JQUERY-174006","severity":"medium","semver":{"vulnerable":["<3.4.0"]}},
-      {"id":"npm:jquery:20160529","severity":"low","semver":{"vulnerable":[">=3.0.0-rc1 <3.0.0"]}},
-      {"id":"npm:jquery:20150627","severity":"medium","semver":{"vulnerable":["<1.12.2",">=1.12.3 <2.2.0",">=2.2.3 <3.0.0"]}},
-      {"id":"npm:jquery:20140902","severity":"medium","semver":{"vulnerable":[">=1.4.2 <1.6.2"]}},
-      {"id":"npm:jquery:20120206","severity":"medium","semver":{"vulnerable":["<1.9.1"]}},
-      {"id":"npm:jquery:20110606","severity":"medium","semver":{"vulnerable":["<1.6.3"]}}
-    ],
-    "jquery-mobile":[
-      {"id":"SNYK-JS-JQUERYMOBILE-174599","severity":"medium","semver":{"vulnerable":["<=1.5.0-alpha.1"]}},
-      {"id":"npm:jquery-mobile:20120802","severity":"medium","semver":{"vulnerable":["<1.2.0"]}}
-    ],
-    "jquery-ui":[
-      {"id":"SNYK-JS-JQUERYUI-1767767","severity":"high","semver":{"vulnerable":["<1.13.0"]}},
-      {"id":"SNYK-JS-JQUERYUI-1767175","severity":"high","semver":{"vulnerable":["<1.13.0"]}},
-      {"id":"SNYK-JS-JQUERYUI-1767167","severity":"high","semver":{"vulnerable":["<1.13.0"]}},
-      {"id":"npm:jquery-ui:20121127","severity":"medium","semver":{"vulnerable":["<1.10.0"]}},
-      {"id":"npm:jquery-ui:20100903","severity":"medium","semver":{"vulnerable":["<1.10.0"]}},
-      {"id":"npm:jquery-ui:20160721","severity":"high","semver":{"vulnerable":["<1.12.0"]}}
-    ],
-    "knockout":[
-      {"id":"npm:knockout:20180213","severity":"medium","semver":{"vulnerable":["<3.5.0-beta"]}},
-      {"id":"npm:knockout:20130701","severity":"medium","semver":{"vulnerable":[">=2.1.0-pre <3.0.0"]}}
-    ],
-    "lodash":[
-      {"id":"SNYK-JS-LODASH-1040724","severity":"high","semver":{"vulnerable":["<4.17.21"]}},
-      {"id":"SNYK-JS-LODASH-1018905","severity":"medium","semver":{"vulnerable":["<4.17.21"]}},
-      {"id":"SNYK-JS-LODASH-608086","severity":"high","semver":{"vulnerable":["<4.17.17"]}},
-      {"id":"SNYK-JS-LODASH-567746","severity":"high","semver":{"vulnerable":["<4.17.20"]}},
-      {"id":"SNYK-JS-LODASH-450202","severity":"high","semver":{"vulnerable":["<4.17.12"]}},
-      {"id":"SNYK-JS-LODASH-73639","severity":"medium","semver":{"vulnerable":["<4.17.11"]}},
-      {"id":"SNYK-JS-LODASH-73638","severity":"high","semver":{"vulnerable":["<4.17.11"]}},
-      {"id":"npm:lodash:20180130","severity":"medium","semver":{"vulnerable":["<4.17.5"]}}
-    ],
-    "moment":[
-      {"id":"SNYK-JS-MOMENT-2440688","severity":"high","semver":{"vulnerable":["<2.29.2"]}},
-      {"id":"npm:moment:20170905","severity":"low","semver":{"vulnerable":["<2.19.3"]}},
-      {"id":"npm:moment:20161019","severity":"medium","semver":{"vulnerable":["<2.15.2"]}},
-      {"id":"npm:moment:20160126","severity":"medium","semver":{"vulnerable":["<2.11.2"]}}
-    ],
-    "mustache":[
-      {"id":"npm:mustache:20151207","severity":"medium","semver":{"vulnerable":["<2.2.1"]}},
-      {"id":"npm:mustache:20110814","severity":"medium","semver":{"vulnerable":["< 0.3.1"]}}
-    ],
-    "next":[
-      {"id":"SNYK-JS-NEXT-2405694","severity":"medium","semver":{"vulnerable":[">=10.0.0 <12.1.0"]}},
-      {"id":"SNYK-JS-NEXT-2388583","severity":"medium","semver":{"vulnerable":[">=12.0.0 <12.0.9"]}},
-      {"id":"SNYK-JS-NEXT-2312745","severity":"high","semver":{"vulnerable":[">=12.0.0 <12.0.5",">=11.1.0 <11.1.3"]}},
-      {"id":"SNYK-JS-NEXT-1577139","severity":"medium","semver":{"vulnerable":[">=10.0.0 <11.1.1"]}},
-      {"id":"SNYK-JS-NEXT-1540422","severity":"medium","semver":{"vulnerable":["<11.1.0"]}},
-      {"id":"SNYK-JS-NEXT-1063481","severity":"medium","semver":{"vulnerable":[">=9.5.0 <9.5.4"]}},
-      {"id":"SNYK-JS-NEXT-571938","severity":"high","semver":{"vulnerable":["<5.1.0"]}},
-      {"id":"SNYK-JS-NEXT-561584","severity":"medium","semver":{"vulnerable":["<9.3.2"]}},
-      {"id":"SNYK-JS-NEXT-174590","severity":"high","semver":{"vulnerable":["<2.4.1"]}},
-      {"id":"SNYK-JS-NEXT-72454","severity":"medium","semver":{"vulnerable":[">=7.0.0 <7.0.2"]}},
-      {"id":"npm:next:20180124","severity":"high","semver":{"vulnerable":["<4.2.3"]}},
-      {"id":"npm:next:20170607","severity":"medium","semver":{"vulnerable":["<2.4.3"]}},
-      {"id":"npm:next:20170601","severity":"high","semver":{"vulnerable":["<2.4.1",">=3.0.0-beta1 <3.0.0-beta7"]}}
-    ],
-    "react":[
-      {"id":"npm:react:20150318","severity":"high","semver":{"vulnerable":[">=0.0.1 <0.14.0"]}},
-      {"id":"npm:react:20131217","severity":"medium","semver":{"vulnerable":[">=0.5.0 <0.5.2",">=0.4.0 <0.4.2"]}}
-    ],
-    "riot":[
-      {"id":"npm:riot:20131114","severity":"medium","semver":{"vulnerable":["<0.9.6"]}}
-    ],
-    "socket.io":[
-      {"id":"SNYK-JS-SOCKETIO-1024859","severity":"medium","semver":{"vulnerable":["<2.4.0"]}},
-      {"id":"npm:socket.io:20120417","severity":"medium","semver":{"vulnerable":["<0.9.6"]}},
-      {"id":"npm:socket.io:20120323","severity":"medium","semver":{"vulnerable":["<0.9.7"]}}
-    ],
-    "three":[
-      {"id":"SNYK-JS-THREE-1064931","severity":"high","semver":{"vulnerable":["<0.125.0"]}}
-    ],
-    "underscore":[
-      {"id":"SNYK-JS-UNDERSCORE-1080984","severity":"medium","semver":{"vulnerable":[">=1.13.0-0 <1.13.0-2",">=1.3.2 <1.12.1"]}}
-    ],
-    "vue":[
-      {"id":"npm:vue:20170829","severity":"medium","semver":{"vulnerable":["<2.4.3"]}},
-      {"id":"npm:vue:20170401","severity":"medium","semver":{"vulnerable":["<2.3.0-beta.1"]}},
-      {"id":"npm:vue:20180802","severity":"medium","semver":{"vulnerable":["<2.5.17"]}},
-      {"id":"npm:vue:20180222","severity":"low","semver":{"vulnerable":["<2.5.14"]}}
-    ],
-    "yui":[
-      {"id":"npm:yui:20130604","severity":"medium","semver":{"vulnerable":[">=3.0.0 <3.10.1","=3.10.2"]}},
-      {"id":"npm:yui:20130515","severity":"medium","semver":{"vulnerable":["<3.10.0 >=3.0.0"]}},
-      {"id":"npm:yui:20121030","severity":"medium","semver":{"vulnerable":["<3.0.0 >=2.4.0"]}},
-      {"id":"npm:yui:20120428","severity":"medium","semver":{"vulnerable":["<3.5.1 >=3.5.0-PR1"]}},
-      {"id":"npm:yui:20101025","severity":"medium","semver":{"vulnerable":["<2.8.2 >=2.4.0"]}}
-    ]
-  }
-}