Skip to content

Commit 33bd497

Browse files
marco-ippolitomarco-ippolito
committed
chore: remove indirect node dependencies
1 parent e9862c2 commit 33bd497

File tree

2 files changed

+57
-45
lines changed

2 files changed

+57
-45
lines changed

‎tools/eol_cve/eol-cve.csv‎

Lines changed: 0 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,4 @@
11
cve,vulnerable,patched,affectedEOL
2-
CVE-2017-1000381,"8.x || 7.x || 4.x || 6.x || 5.x","^8.1.4 || ^7.10.1 || ^4.8.4 || ^6.11.1","5.x || 7.x"
3-
CVE-2017-3731,"4.x || 5.x || 6.x || 7.x","^4.7.3 || ^6.9.5 || ^7.5.0",5.x
4-
CVE-2017-3732,"4.x || 5.x || 6.x || 7.x","^4.7.3 || ^6.9.5 || ^7.5.0",5.x
5-
CVE-2016-7055,"4.x || 5.x || 6.x || 7.x","^4.7.3 || ^6.9.5 || ^7.5.0",5.x
6-
CVE-2016-9551,^7.1.0,^7.2.0,5.x
7-
CVE-2016-9840,"4.x || 5.x || 6.x || 7.x","^4.8.2 || ^6.10.2 || ^7.6.0",5.x
8-
CVE-2016-9841,"4.x || 5.x || 6.x || 7.x","^4.8.2 || ^6.10.2 || ^7.6.0",5.x
9-
CVE-2016-9842,"4.x || 5.x || 6.x || 7.x","^4.8.2 || ^6.10.2 || ^7.6.0",5.x
10-
CVE-2016-9843,"4.x || 5.x || 6.x || 7.x","^4.8.2 || ^6.10.2 || ^7.6.0",5.x
11-
CVE-2016-5172,6.x,^6.9.0,5.x
12-
CVE-2016-6304,"6.x || 5.x || 4.x","^6.7.0 || ^4.6.0",5.x
13-
CVE-2016-2183,"6.x || 5.x || 4.x","^6.7.0 || ^4.6.0",5.x
14-
CVE-2016-6303,"6.x || 5.x || 4.x","^6.7.0 || ^4.6.0",5.x
15-
CVE-2016-2178,"6.x || 5.x || 4.x","^6.7.0 || ^4.6.0",5.x
16-
CVE-2016-6306,"6.x || 5.x || 4.x","^6.7.0 || ^4.6.0",5.x
17-
CVE-2016-5325,"6.x || 4.x || 5.x","^6.7.0 || ^4.6.0",5.x
18-
CVE-2016-7099,"6.x || 4.x || 5.x","^6.7.0 || ^4.6.0",5.x
19-
CVE-2017-14849,8.5.0,^8.6.0,"5.x || 7.x"
20-
CVE-2017-14919,"^4.8.2 || ^6.10.2 || 8.x","^4.8.5 || ^6.11.5 || ^8.8.0","5.x || 7.x"
212
CVE-2017-15896,"4.x || 6.x || 8.x || 9.x","^4.8.7 || ^6.12.2 || ^8.9.3 || ^9.2.1","5.x || 7.x"
223
CVE-2017-15897,"8.x || 9.x","^8.9.3 || ^9.2.1","5.x || 7.x"
234
CVE-2018-7159,"4.x || 6.x || 8.x || 9.x","^4.9.0 || ^6.14.0 || ^8.11.0 || ^9.10.0","5.x || 7.x"
@@ -35,14 +16,6 @@ CVE-2018-12122,"6.x || 8.x || 10.x || 11.x","^6.15.0 || ^8.14.0 || ^10.14.0 || ^
3516
CVE-2018-12123,"6.x || 8.x || 10.x || 11.x","^6.15.0 || ^8.14.0 || ^10.14.0 || ^11.3.0","4.x || 5.x || 7.x || 9.x"
3617
CVE-2019-5737,"6.x || 8.x || 10.x || 11.x","^6.17.0 || ^8.15.1 || ^10.15.2 || ^11.10.1","4.x || 5.x || 7.x || 9.x"
3718
CVE-2019-5739,6.x,^6.17.0,"4.x || 5.x"
38-
CVE-2019-9511,"8.x || 10.x || 12.x","^8.16.1 || ^10.16.3 || ^12.8.1","4.x || 5.x || 6.x || 7.x || 9.x || 11.x"
39-
CVE-2019-9512,"8.x || 10.x || 12.x","^8.16.1 || ^10.16.3 || ^12.8.1","4.x || 5.x || 6.x || 7.x || 9.x || 11.x"
40-
CVE-2019-9513,"8.x || 10.x || 12.x","^8.16.1 || ^10.16.3 || ^12.8.1","4.x || 5.x || 6.x || 7.x || 9.x || 11.x"
41-
CVE-2019-9514,"8.x || 10.x || 12.x","^8.16.1 || ^10.16.3 || ^12.8.1","4.x || 5.x || 6.x || 7.x || 9.x || 11.x"
42-
CVE-2019-9515,"8.x || 10.x || 12.x","^8.16.1 || ^10.16.3 || ^12.8.1","4.x || 5.x || 6.x || 7.x || 9.x || 11.x"
43-
CVE-2019-9516,"8.x || 10.x || 12.x","^8.16.1 || ^10.16.3 || ^12.8.1","4.x || 5.x || 6.x || 7.x || 9.x || 11.x"
44-
CVE-2019-9517,"8.x || 10.x || 12.x","^8.16.1 || ^10.16.3 || ^12.8.1","4.x || 5.x || 6.x || 7.x || 9.x || 11.x"
45-
CVE-2019-9518,"8.x || 10.x || 12.x","^8.16.1 || ^10.16.3 || ^12.8.1","4.x || 5.x || 6.x || 7.x || 9.x || 11.x"
4619
CVE-2019-15604,"10.x || 12.x || 13.x","^10.19.0 || ^12.15.0 || ^13.8.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x"
4720
CVE-2019-15605,"10.x || 12.x || 13.x","^10.19.0 || ^12.15.0 || ^13.8.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x"
4821
CVE-2019-15606,"10.x || 12.x || 13.x","^10.19.0 || ^12.15.0 || ^13.8.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x"
@@ -52,33 +25,20 @@ CVE-2020-8252,"10.x || 12.x || 14.x","^10.22.1 || ^12.18.4 || ^14.9.0","4.x || 5
5225
CVE-2020-8277," 12.x || 14.x || 15.x"," ^12.19.1 || ^14.15.1 || 15.2.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
5326
CVE-2020-8265,"10.x || 12.x || 14.x || 15.x","^10.23.1 || ^12.20.1 || ^14.15.4 || ^15.5.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
5427
CVE-2020-8287,"10.x || 12.x || 14.x || 15.x","^10.23.1 || ^12.20.1 || ^14.15.4 || ^15.5.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
55-
CVE-2020-1971,"10.x || 12.x || 14.x || 15.x","^10.23.1 || ^12.20.1 || ^14.15.4 || ^15.5.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
5628
CVE-2021-22883," 10.x || 12.x || 14.x || 15.x"," ^10.24.0 || ^12.21.0 || ^14.16.0 || ^15.10.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
5729
CVE-2021-22884," 10.x || 12.x || 14.x || 15.x"," ^10.24.0 || ^12.21.0 || ^14.16.0 || ^15.10.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
58-
CVE-2021-23840," 10.x || 12.x || 14.x || 15.x"," ^10.24.0 || ^12.21.0 || ^14.16.0 || ^15.10.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
59-
CVE-2021-3450," 10.x || 12.x || 14.x || 15.x"," ^10.24.1 || ^12.22.1 || ^14.16.1 || ^15.14.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
60-
CVE-2021-3449," 10.x || 12.x || 14.x || 15.x"," ^10.24.1 || ^12.22.1 || ^14.16.1 || ^15.14.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
61-
CVE-2020-7774," 10.x || 12.x || 14.x"," ^10.24.1 || ^12.22.1 || ^14.16.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
6230
CVE-2021-22930," 12.x || 14.x || 16.x"," ^12.22.4 || ^14.17.4 || ^16.6.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
6331
CVE-2021-22921," 12.x || 14.x || 16.x"," ^12.22.2 || ^14.17.2 || ^16.4.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
64-
CVE-2021-27290, 12.x, ^12.22.2,"4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x"
65-
CVE-2021-23362, 12.x, ^12.22.2,"4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x"
6632
CVE-2021-22918," 12.x || 14.x || 16.x"," ^12.22.2 || ^14.17.2 || ^16.4.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
6733
CVE-2021-22931,"12.x || 14.x || 16.x","^12.22.5 || ^14.17.5 || ^16.6.2","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
6834
CVE-2021-22940,"12.x || 14.x || 16.x","^12.22.5 || ^14.17.5 || ^16.6.2","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
6935
CVE-2021-22939,"12.x || 14.x || 16.x","^12.22.5 || ^14.17.5 || ^16.6.2","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
70-
CVE-2021-37701," 12.x || 14.x"," ^12.22.6 || ^14.17.6","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x"
71-
CVE-2021-37712," 12.x || 14.x"," ^12.22.6 || ^14.17.6","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x"
72-
CVE-2021-37713," 12.x || 14.x"," ^12.22.6 || ^14.17.6","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x"
73-
CVE-2021-39134," 12.x || 14.x"," ^12.22.6 || ^14.17.6","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x"
74-
CVE-2021-39135," 12.x || 14.x"," ^12.22.6 || ^14.17.6","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x"
7536
CVE-2021-22959,"12.x || 14.x || 16.x"," ^12.22.7 || ^14.18.1 || ^16.11.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
7637
CVE-2021-22960,"12.x || 14.x || 16.x"," ^12.22.7 || ^14.18.1 || ^16.11.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
7738
CVE-2021-44531,"12.x || 14.x || 16.x || 17.x","^12.22.9 || ^14.18.3 || ^16.13.2 || ^17.3.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
7839
CVE-2021-44532,"12.x || 14.x || 16.x || 17.x","^12.22.9 || ^14.18.3 || ^16.13.2 || ^17.3.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
7940
CVE-2021-44533,"12.x || 14.x || 16.x || 17.x","^12.22.9 || ^14.18.3 || ^16.13.2 || ^17.3.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
8041
CVE-2022-21824,"12.x || 14.x || 16.x || 17.x","^12.22.9 || ^14.18.3 || ^16.13.2 || ^17.3.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
81-
CVE-2022-0778,"12.x || 14.x || 16.x || 17.x","^12.22.11 || ^14.19.1 || ^16.14.2 || ^17.7.2","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
8242
CVE-2022-32215,"14.x || 16.x || 18.x","^14.20.1 || ^16.17.1 || ^18.9.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
8343
CVE-2022-32214,"14.x || 16.x || 18.x","^14.20.0 || ^16.20.0 || ^18.5.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
8444
CVE-2022-32212,"14.x || 16.x || 18.x","^14.20.1 || ^16.17.1 || ^18.9.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
@@ -90,8 +50,6 @@ CVE-2022-35255,18.x,^18.9.1,"4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 1
9050
CVE-2022-43548,"14.x || 16.x || 18.x || 19.x","^14.21.1 || ^16.18.1 || ^18.12.1 || ^19.0.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
9151
CVE-2023-23918,"14.x || 16.x || 18.x || 19.x","^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.6.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
9252
CVE-2023-23919,"14.x || 16.x || 18.x || 19.x","^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.2.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
93-
CVE-2023-23936,"14.x || 16.x || 18.x || 19.x","^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.6.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
94-
CVE-2023-24807,"14.x || 16.x || 18.x || 19.x","^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.6.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
9553
CVE-2023-23920,"14.x || 16.x || 18.x || 19.x","^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.6.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
9654
CVE-2023-30581,"16.x || 18.x || 20.x","^16.20.1 || ^18.16.1 || ^20.3.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 17.x || 19.x"
9755
CVE-2023-30582,20.x,^20.3.1,"4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 17.x || 19.x"
@@ -110,8 +68,6 @@ CVE-2023-32006,"16.x || 18.x || 20.x","^16.20.2 || ^18.17.1 || ^20.5.1","4.x ||
11068
CVE-2023-32559,"16.x || 18.x || 20.x","^16.20.2 || ^18.17.1 || ^20.5.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 17.x || 19.x"
11169
CVE-2023-32005,20.x,^20.5.1,"4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 17.x || 19.x"
11270
CVE-2023-32003,20.x,^20.5.1,"4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 17.x || 19.x"
113-
CVE-2023-45143,"18.x || 20.x","^18.18.2 || ^20.8.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 16.x || 17.x || 19.x"
114-
CVE-2023-44487,"18.x || 20.x","^18.18.2 || ^20.8.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 16.x || 17.x || 19.x"
11571
CVE-2023-39331,20.x,^20.8.1,"4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 16.x || 17.x || 19.x"
11672
CVE-2023-39332,20.x,^20.8.1,"4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 16.x || 17.x || 19.x"
11773
CVE-2023-38552,"18.x || 20.x","^18.18.2 || ^20.8.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 16.x || 17.x || 19.x"

‎tools/eol_cve/index.js‎

Lines changed: 57 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ const { format } = require('fast-csv');
44
const { resolve } = require('path');
55
const semver = require('semver');
66
const nv = require('@pkgjs/nv');
7+
const { setTimeout } = require('node:timers/promises');
78

89
const csvStream = format({ headers: true });
910
const filePath = resolve(__dirname, 'eol-cve.csv');
@@ -14,6 +15,52 @@ const MINIMUM_VERSION = 4;
1415

1516
const RELEASE_SCHEDULE_JSON = 'https://raw.githubusercontent.com/nodejs/Release/main/schedule.json';
1617

18+
const NVD_API_URL = "https://services.nvd.nist.gov/rest/json/cves/2.0";
19+
20+
async function isNodeCVE(cveId) {
21+
const queryParams = new URLSearchParams({
22+
cveId: cveId,
23+
});
24+
25+
const response = await fetch(`${NVD_API_URL}?${queryParams.toString()}`, {
26+
headers: {
27+
'apiKey': process.env.NVD_TOKEN,
28+
}
29+
});
30+
if (!response.ok) {
31+
console.error(
32+
`Error fetching data: ${response.status} ${response.statusText}`,
33+
);
34+
process.exit(1);
35+
}
36+
const data = await response.json();
37+
38+
const { vulnerabilities } = data;
39+
if (!vulnerabilities || vulnerabilities.length === 0) {
40+
return false;
41+
}
42+
43+
const { cve } = vulnerabilities.at(0);
44+
const { references } = cve;
45+
46+
if (references?.length) {
47+
// Try to identify if the CVE is related to Node.js
48+
// by checking the references
49+
for (const reference of references) {
50+
const { url, source } = reference;
51+
const validReferences = ['nodejs.org/en/blog/vulnerability', 'hackerone.com/reports/', 'www.openwall.com/lists/oss-security/']
52+
const validSources = ['[email protected]', '[email protected]']
53+
for (const validReference of validReferences) {
54+
if (url.includes(validReference) && validSources.includes(source)) {
55+
return true;
56+
}
57+
}
58+
}
59+
}
60+
61+
return false;
62+
}
63+
1764
async function fetchReleasesSchedule() {
1865
try {
1966
const response = await fetch(RELEASE_SCHEDULE_JSON);
@@ -69,6 +116,15 @@ async function run() {
69116

70117
// Each vulnerability can have multiple CVEs
71118
for (const cve of vuln.cve) {
119+
if (!await isNodeCVE(cve)) {
120+
continue;
121+
}
122+
// Otherwise NVD will block us
123+
// Rate limit is 50 requests per 30 second with token
124+
// and 5 requests per 30 seconds without token
125+
const timeout = process.env.NVD_TOKEN ? 750 : 5000;
126+
await setTimeout(timeout);
127+
72128
const last = getLastAffectedVersion(vuln.vulnerable);
73129
// Skip 0.x and 4.x versions
74130
if (last <= MINIMUM_VERSION) continue;
@@ -96,7 +152,7 @@ async function run() {
96152
return releaseDate > eol;
97153
});
98154

99-
if(releaseMajors.length === 0) continue;
155+
if (releaseMajors.length === 0) continue;
100156

101157
// Write into the format v4.x || v5.x || v6.x
102158
const missing = releaseMajors.map((n) => `${n}.x`).join(' || ');

0 commit comments

Comments
 (0)