Cypress has older jquerys with common vulnerabilities

[joyarzun]

• Operating System: Linux 4.9.71-1-MANJARO
• Cypress Version: 1.4.1
• Browser Version: in console

Is this a Feature or Bug?

Bug

Current behavior:

Retirejs find jquerys with CVE:

Loading from cache: https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json
Loading from cache: https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/npmrepository.json
/home/joyarzun/latam/SX/cypress-test-tiny/node_modules/cypress/dist/Cypress/resources/app/packages/runner/dist/cypress_runner.js
 ↳ jquery 2.2.4 has known vulnerabilities: severity: medium; issue: 2432, summary: 3rd party CORS request may execute; https://github.com/jquery/jquery/issues/2432 http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/ http://research.insecurelabs.org/jquery/test/ severity: medium; issue: 11974, summary: parseHTML() executes scripts in event handlers; https://bugs.jquery.com/ticket/11974 http://research.insecurelabs.org/jquery/test/
 ↳ moment.js 2.19.0
/home/joyarzun/latam/SX/cypress-test-tiny/node_modules/cypress/dist/Cypress/resources/app/packages/server/node_modules/ansi_up/examples/jquery-1.7.2.min.js
 ↳ jquery 1.7.2.min has known vulnerabilities: severity: medium; bug: 11290, summary: Selector interpreted as HTML; http://bugs.jquery.com/ticket/11290 http://research.insecurelabs.org/jquery/test/ severity: medium; issue: 2432, summary: 3rd party CORS request may execute; https://github.com/jquery/jquery/issues/2432 http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/ http://research.insecurelabs.org/jquery/test/
/home/joyarzun/latam/SX/cypress-test-tiny/node_modules/cypress/dist/Cypress/resources/app/packages/server/node_modules/lexical-scope/bench/jquery.js
 ↳ jquery 1.7.1 has known vulnerabilities: severity: medium; bug: 11290, summary: Selector interpreted as HTML; http://bugs.jquery.com/ticket/11290 http://research.insecurelabs.org/jquery/test/ severity: medium; issue: 2432, summary: 3rd party CORS request may execute; https://github.com/jquery/jquery/issues/2432 http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/ http://research.insecurelabs.org/jquery/test/
/home/joyarzun/latam/SX/cypress-test-tiny/node_modules/cypress/dist/Cypress/resources/app/packages/server/node_modules/cson/docs/assets/biscotto.js
 ↳ jquery 1.8.1 has known vulnerabilities: severity: medium; bug: 11290, summary: Selector interpreted as HTML; http://bugs.jquery.com/ticket/11290 http://research.insecurelabs.org/jquery/test/ severity: medium; issue: 2432, summary: 3rd party CORS request may execute; https://github.com/jquery/jquery/issues/2432 http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/ http://research.insecurelabs.org/jquery/test/ severity: medium; issue: 11974, summary: parseHTML() executes scripts in event handlers; https://bugs.jquery.com/ticket/11974 http://research.insecurelabs.org/jquery/test/

Desired behavior:

retire command it should pass without errors

How to reproduce:

git clone git@github.com:cypress-io/cypress-test-tiny.git
cd cypress-test-tiny
npm i cypress retire -D
./node_modules/.bin/retire

[jennifer-shehane]

Duplicate of #1215

[joyarzun]

Maybe this issue is not a duplicate because the path "cypress-test-tiny/node_modules/cypress/dist/Cypress/resources/app/packages/server/node_modules/ansi_up/examples/jquery-1.7.2.min.js" not point to Cypress node_module directly

[jennifer-shehane]

Our server includes ansi-up as a node_mobulde which has a very old version of jQuery included in their examples, not in their dist code: https://github.com/drudru/ansi_up/tree/master/examples