Added retire.js for Module Vulnerability Scanning

.github/workflows/test.yaml

@@ -89,4 +89,7 @@ jobs:
         run: npm run coverage
 
       - name: Test coverage
-        uses: coverallsapp/github-action@v2
+        uses: coverallsapp/github-action@v2
+
+      - name: Security Scan
+        run: npm run security-scan

.retireignore

@@ -0,0 +1 @@
+node_modules/

UserGuide.md

@@ -363,8 +363,6 @@ Filter with no inputs to see if that causes issues.
 **Why you believe the tests are sufficient**
 I believe that the tests are sufficient, as knowing that bad inputs won’t cause issues through testing with NodeBB, we can focus on making sure that the functionality of the date filtering is good. These tests check to see if the backend function is getting the topics correctly by date and not getting ones unrelated, which is the primary function of the date filter button. These tests also account for new categories to make sure that each category comes with a functioning date filtering button.
 
----
-
 ## Deployed Application
 
-Access the live deployment at: [`http://17313-team21.s3d.cmu.edu:4567/`](http://17313-team21.s3d.cmu.edu:4567/)
+Access the live deployment at: [`http://17313-team21.s3d.cmu.edu:4567/`](http://17313-team21.s3d.cmu.edu:4567/)

install/package.json

@@ -14,7 +14,8 @@
         "lint": "eslint --cache ./nodebb .",
         "test": "nyc --reporter=html --reporter=text-summary mocha",
         "coverage": "nyc report --reporter=text-lcov > ./coverage/lcov.info",
-        "coveralls": "nyc report --reporter=text-lcov | coveralls && rm -r coverage"
+        "coveralls": "nyc report --reporter=text-lcov | coveralls && rm -r coverage",
+        "security-scan": "retire --path . --outputformat json"
     },
     "nyc": {
         "exclude": [
@@ -173,6 +174,7 @@
         "mocha-lcov-reporter": "1.3.0",
         "mockdate": "3.0.5",
         "nyc": "17.1.0",
+        "retire": "^5.3.0",
         "smtp-server": "3.13.6"
     },
     "optionalDependencies": {

package.json

@@ -14,7 +14,8 @@
         "lint": "eslint --cache ./nodebb .",
         "test": "nyc --reporter=html --reporter=text-summary mocha",
         "coverage": "nyc report --reporter=text-lcov > ./coverage/lcov.info",
-        "coveralls": "nyc report --reporter=text-lcov | coveralls && rm -r coverage"
+        "coveralls": "nyc report --reporter=text-lcov | coveralls && rm -r coverage",
+        "security-scan": "retire --path . --outputformat json"
     },
     "nyc": {
         "exclude": [
@@ -174,6 +175,7 @@
         "mocha-lcov-reporter": "1.3.0",
         "mockdate": "3.0.5",
         "nyc": "17.1.0",
+        "retire": "^5.3.0",
         "smtp-server": "3.13.6"
     },
     "optionalDependencies": {

retirejs-output.txt

@@ -0,0 +1,293 @@
+
+> nodebb@4.4.6 security-scan
+> retire --path . --outputformat json | jq
+
+{
+  "version": "5.3.0",
+  "start": "2025-10-24T02:37:56.857Z",
+  "data": [
+    {
+      "file": "/workspaces/nodebb-fall-2025-null-terminators/node_modules/gaze/lib/helper.js",
+      "results": [
+        {
+          "version": "1.0.1",
+          "component": "lodash",
+          "detection": "filecontent",
+          "vulnerabilities": [
+            {
+              "info": [
+                "https://github.com/advisories/GHSA-fvqr-27wr-82fm",
+                "https://nvd.nist.gov/vuln/detail/CVE-2018-3721",
+                "https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a",
+                "https://hackerone.com/reports/310443",
+                "https://github.com/advisories/GHSA-fvqr-27wr-82fm",
+                "https://security.netapp.com/advisory/ntap-20190919-0004/",
+                "https://www.npmjs.com/advisories/577"
+              ],
+              "below": "4.17.5",
+              "severity": "medium",
+              "identifiers": {
+                "summary": "Prototype Pollution in lodash",
+                "CVE": [
+                  "CVE-2018-3721"
+                ],
+                "githubID": "GHSA-fvqr-27wr-82fm"
+              },
+              "cwe": [
+                "CWE-471",
+                "CWE-1321"
+              ]
+            },
+            {
+              "info": [
+                "https://github.com/advisories/GHSA-4xc9-xhrj-v574",
+                "https://nvd.nist.gov/vuln/detail/CVE-2018-16487",
+                "https://github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad",
+                "https://hackerone.com/reports/380873",
+                "https://github.com/advisories/GHSA-4xc9-xhrj-v574",
+                "https://security.netapp.com/advisory/ntap-20190919-0004/",
+                "https://www.npmjs.com/advisories/782"
+              ],
+              "below": "4.17.11",
+              "severity": "high",
+              "identifiers": {
+                "summary": "Prototype Pollution in lodash",
+                "CVE": [
+                  "CVE-2018-16487"
+                ],
+                "githubID": "GHSA-4xc9-xhrj-v574"
+              },
+              "cwe": [
+                "CWE-400"
+              ]
+            },
+            {
+              "info": [
+                "https://github.com/advisories/GHSA-jf85-cpcp-j695",
+                "https://nvd.nist.gov/vuln/detail/CVE-2019-10744",
+                "https://github.com/lodash/lodash/pull/4336",
+                "https://access.redhat.com/errata/RHSA-2019:3024",
+                "https://security.netapp.com/advisory/ntap-20191004-0005/",
+                "https://snyk.io/vuln/SNYK-JS-LODASH-450202",
+                "https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS",
+                "https://www.npmjs.com/advisories/1065",
+                "https://www.oracle.com/security-alerts/cpujan2021.html",
+                "https://www.oracle.com/security-alerts/cpuoct2020.html"
+              ],
+              "below": "4.17.12",
+              "severity": "high",
+              "identifiers": {
+                "summary": "Prototype Pollution in lodash",
+                "CVE": [
+                  "CVE-2019-10744"
+                ],
+                "githubID": "GHSA-jf85-cpcp-j695"
+              },
+              "cwe": [
+                "CWE-1321",
+                "CWE-20"
+              ]
+            },
+            {
+              "info": [
+                "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
+                "https://nvd.nist.gov/vuln/detail/CVE-2021-23337",
+                "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
+                "https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf",
+                "https://github.com/lodash/lodash",
+                "https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851",
+                "https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851",
+                "https://security.netapp.com/advisory/ntap-20210312-0006/",
+                "https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932",
+                "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930",
+                "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928",
+                "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931",
+                "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929",
+                "https://snyk.io/vuln/SNYK-JS-LODASH-1040724",
+                "https://www.oracle.com//security-alerts/cpujul2021.html",
+                "https://www.oracle.com/security-alerts/cpujan2022.html",
+                "https://www.oracle.com/security-alerts/cpujul2022.html",
+                "https://www.oracle.com/security-alerts/cpuoct2021.html"
+              ],
+              "below": "4.17.21",
+              "severity": "high",
+              "identifiers": {
+                "summary": "Command Injection in lodash",
+                "CVE": [
+                  "CVE-2021-23337"
+                ],
+                "githubID": "GHSA-35jh-r3h4-6jhm"
+              },
+              "cwe": [
+                "CWE-77",
+                "CWE-94"
+              ]
+            }
+          ],
+          "licenses": [
+            "MIT"
+          ]
+        }
+      ]
+    },
+    {
+      "file": "/workspaces/nodebb-fall-2025-null-terminators/node_modules/mousetrap/tests/libs/jquery-1.7.2.min.js",
+      "results": [
+        {
+          "version": "1.7.2",
+          "component": "jquery",
+          "npmname": "jquery",
+          "detection": "filename",
+          "vulnerabilities": [
+            {
+              "info": [
+                "http://bugs.jquery.com/ticket/11290",
+                "http://research.insecurelabs.org/jquery/test/",
+                "https://nvd.nist.gov/vuln/detail/CVE-2012-6708"
+              ],
+              "below": "1.9.0b1",
+              "severity": "medium",
+              "identifiers": {
+                "summary": "Selector interpreted as HTML",
+                "CVE": [
+                  "CVE-2012-6708"
+                ],
+                "bug": "11290",
+                "githubID": "GHSA-2pqj-h3vj-pqgw"
+              },
+              "cwe": [
+                "CWE-64",
+                "CWE-79"
+              ]
+            },
+            {
+              "info": [
+                "https://github.com/advisories/GHSA-q4m3-2j7h-f7xw",
+                "https://nvd.nist.gov/vuln/detail/CVE-2020-7656",
+                "https://research.insecurelabs.org/jquery/test/"
+              ],
+              "below": "1.9.0",
+              "atOrAbove": "1.2.1",
+              "severity": "medium",
+              "identifiers": {
+                "summary": "Versions of jquery prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove \"<script>\" HTML tags that contain a whitespace character, i.e: \"</script >\", which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 1.9.0 or later.",
+                "CVE": [
+                  "CVE-2020-7656"
+                ],
+                "githubID": "GHSA-q4m3-2j7h-f7xw"
+              },
+              "cwe": [
+                "CWE-79"
+              ]
+            },
+            {
+              "info": [
+                "http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/",
+                "http://research.insecurelabs.org/jquery/test/",
+                "https://bugs.jquery.com/ticket/11974",
+                "https://github.com/advisories/GHSA-rmxg-73gg-4p98",
+                "https://github.com/jquery/jquery/issues/2432",
+                "https://nvd.nist.gov/vuln/detail/CVE-2015-9251"
+              ],
+              "below": "1.12.0",
+              "atOrAbove": "1.4.0",
+              "severity": "medium",
+              "identifiers": {
+                "summary": "3rd party CORS request may execute",
+                "issue": "2432",
+                "CVE": [
+                  "CVE-2015-9251"
+                ],
+                "githubID": "GHSA-rmxg-73gg-4p98"
+              },
+              "cwe": [
+                "CWE-79"
+              ]
+            },
+            {
+              "info": [
+                "https://github.com/jquery/jquery.com/issues/162"
+              ],
+              "below": "2.999.999",
+              "severity": "low",
+              "identifiers": {
+                "summary": "jQuery 1.x and 2.x are End-of-Life and no longer receiving security updates",
+                "retid": "73",
+                "issue": "162"
+              },
+              "cwe": [
+                "CWE-1104"
+              ]
+            },
+            {
+              "info": [
+                "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/",
+                "https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b",
+                "https://nvd.nist.gov/vuln/detail/CVE-2019-11358"
+              ],
+              "below": "3.4.0",
+              "atOrAbove": "1.1.4",
+              "severity": "medium",
+              "identifiers": {
+                "summary": "jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution",
+                "CVE": [
+                  "CVE-2019-11358"
+                ],
+                "PR": "4333",
+                "githubID": "GHSA-6c3j-c64m-qhgq"
+              },
+              "cwe": [
+                "CWE-1321",
+                "CWE-79"
+              ]
+            },
+            {
+              "info": [
+                "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/"
+              ],
+              "below": "3.5.0",
+              "atOrAbove": "1.0.3",
+              "severity": "medium",
+              "identifiers": {
+                "summary": "passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.",
+                "CVE": [
+                  "CVE-2020-11023"
+                ],
+                "issue": "4647",
+                "githubID": "GHSA-jpcq-cgw6-v4j6"
+              },
+              "cwe": [
+                "CWE-79"
+              ]
+            },
+            {
+              "info": [
+                "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/"
+              ],
+              "below": "3.5.0",
+              "atOrAbove": "1.2.0",
+              "severity": "medium",
+              "identifiers": {
+                "summary": "Regex in its jQuery.htmlPrefilter sometimes may introduce XSS",
+                "CVE": [
+                  "CVE-2020-11022"
+                ],
+                "issue": "4642",
+                "githubID": "GHSA-gxr4-xjj5-5px2"
+              },
+              "cwe": [
+                "CWE-79"
+              ]
+            }
+          ],
+          "licenses": [
+            "MIT"
+          ]
+        }
+      ]
+    }
+  ],
+  "messages": [],
+  "errors": [],
+  "time": 33.584
+}