Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

#1588 - Download Report Functionality using existing components #1743

Closed
wants to merge 15 commits into from
Closed
Show file tree
Hide file tree
Changes from 12 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
215 changes: 215 additions & 0 deletions Client/package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions Client/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@
"axios": "^1.7.4",
"dayjs": "1.11.13",
"flag-icons": "7.3.2",
"html2pdf.js": "^0.10.2",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Yo, let's verify this package version, eh?

The package version uses a caret (^), which could lead to compatibility issues down the road. Let's make sure we're using the most stable version and check for any security concerns.


🌐 Web query:

What is the latest stable version of html2pdf.js and are there any known vulnerabilities?

💡 Result:

The latest stable version of html2pdf.js (the JavaScript library) is v0.9.3, as newer versions (v0.10.x) have reported unresolved issues[3][4]. However, npm lists v0.10.2 as technically the most recent release[3][10].

Key Security Notes:

  1. JS Library Vulnerabilities:

    • No direct CVEs are reported for the JavaScript html2pdf.js package in the provided sources[6].
    • A warning exists for versions ≥0.10 due to unspecified bugs[3][4].
  2. PHP Library Confusion:

    • A separate PHP library (spipu/html2pdf) had critical vulnerabilities:

Recommendations:

  • For JavaScript: Use v0.9.3 until v0.10.x issues are resolved[3][4].
  • For PHP: Ensure spipu/html2pdf is updated to ≥v5.2.8[5][7][8].

Citations:


Yo, heads up on the html2pdf.js dependency!

  • The package is set to "^0.10.2", which, although the most recent release per npm, isn’t actually the most stable version.
  • External research suggests that the stable version is v0.9.3, because releases in the 0.10.x series have unresolved issues—even though there aren’t any direct CVE-reported vulnerabilities.
  • To avoid potential compatibility issues down the road, consider pinning the dependency to v0.9.3 rather than relying on the caret-led upgrade to unstable versions.

"i18next": "^24.2.2",
"immutability-helper": "^3.1.1",
"joi": "17.13.3",
Expand Down
Loading