@nrwl/web:file-server has security vulnerability

[puku0x]

Current Behavior

http-server which is used in @nrwl/web:file-server has been broken by [email protected].

% npm ls colors
[email protected]
├─┬ @nrwl/[email protected]
│ └─┬ [email protected]
│   └── [email protected] 👈 https://github.com/Marak/colors.js/issues/285
└─┬ [email protected]
  └─┬ [email protected]
    └── [email protected]

Expected Behavior

[email protected] is used.

Fortunately, there is a fix PR.
http-party/http-server#783

Steps to Reproduce

Create a workspace and use @nrwl/web:file-server to serve an application.

I think most users are not affected because they use @nrwl/web:dev-server.

Failure Logs

Environment

Node : 16.11.1
  OS   : darwin x64
  npm  : 8.0.0
  
  nx : 13.4.3
  @nrwl/angular : undefined
  @nrwl/cli : 13.4.3
  @nrwl/cypress : 13.4.3
  @nrwl/devkit : 13.4.3
  @nrwl/eslint-plugin-nx : 13.4.3
  @nrwl/express : undefined
  @nrwl/jest : 13.4.3
  @nrwl/linter : 13.4.3
  @nrwl/nest : undefined
  @nrwl/next : undefined
  @nrwl/node : undefined
  @nrwl/nx-cloud : undefined
  @nrwl/react : 13.4.3
  @nrwl/react-native : undefined
  @nrwl/schematics : undefined
  @nrwl/tao : 13.4.3
  @nrwl/web : 13.4.3
  @nrwl/workspace : 13.4.3
  @nrwl/storybook : 13.4.3
  @nrwl/gatsby : undefined
  typescript : 4.4.4
  rxjs : 6.6.7
  ---------------------------------------
  Community plugins:

[SerkanSipahi]

I can confirm this but I get the same issue when running npm run affected:test. This probably affects all Nx versions that install v.1.4.2 with every installation.

As long as we don't have a patch, we can force the version of colors.js to v.1.4.0 by running npm i --save-dev [email protected]. This works so far fine for me.

npm ls colors

├── [email protected]
├─┬ [email protected]
│ └─┬ [email protected] <---
│   └── [email protected]  deduped
├─┬ [email protected] <---
│ └── [email protected]  deduped
└─┬ [email protected]
  └─┬ [email protected]
    └── [email protected]

[puku0x]

Karma😂
karma-runner/karma#3741

[SerkanSipahi]

@puku0x yeah, and lot of other libs! Hopefully the fix will be merged as fast as possible!

[jaysoo]

We're exploring ways around the vulnerability if the patch isn't landed in http-server.

For yarn and npm 8 users, please use resolutions or overrides, everyone else stay tuned!

[github-actions]

This issue has been closed for more than 30 days. If this issue is still occuring, please open a new issue with more recent context.