chore: 🤖 manual merge from main

.github/workflows/ui-release-trigger.yml

@@ -0,0 +1,20 @@
+name: "Trigger Boundary UI release"
+
+on:
+  push:
+    tags:
+      - '*'
+
+jobs:
+  trigger-circleci-release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@master
+      - name: Trigger Release job
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          curl -u ${{ secrets.CIRCLE_TOKEN }}: -X POST --header "Content-Type: application/json" \
+          -d '{ "branch": "main", "parameters": {"TAG": "${TAG}" }}' \
+          https://circleci.com/api/v2/project/github/hashicorp/boundary-ui-releases/pipeline

README.md

@@ -23,6 +23,7 @@ subproject, e.g. running or testing.
   - [Building ToC](#building-toc)
   - [Building Admin UI for Production](#building-admin-ui-for-production)
     - [Building with a Container](#building-with-a-container)
+  - [Building Desktop UI for Production](#building-desktop-ui-for-production)
   - [Committing](#committing)
     - [License Checking](#license-checking)
 
@@ -102,6 +103,25 @@ docker-compose -f docker-compose-embedding.yml run build
 
 Assets are saved to `ui/admin/dist/`.
 
+### Building Desktop UI for Production
+
+See ui/desktop/README.md Building for Production for more information on how to
+build the Desktop UI.  Be sure to set build-related environment variables as
+necessary for your target environment, as described in the Desktop UI readme.
+
+To quickly produce a production build of Desktop UI, run from this folder:
+
+```bash
+yarn install
+yarn build:ui:desktop
+```
+
+To provide a signing identify for macOS build, use `BOUNDARY_DESKTOP_SIGNING_IDENTITY`
+environment variable to set signing certificate name (e.g Developer ID Application: * (*)).
+
+Assets are saved to `ui/desktop/electron-app/out/make/`.
+DMG packaged desktop UI is available at asset location as `Boundary Desktop.dmg`.
+
 ### Committing
 
 Instead of the default `git commit`, we prescribe a custom command that ensures

addons/api/addon/models/session.js

@@ -1,16 +1,43 @@
 import GeneratedSessionModel from '../generated/models/session';
 import { computed } from '@ember/object';
+import { equal } from '@ember/object/computed';
+import { attr } from '@ember-data/model';
 
 export default class SessionModel extends GeneratedSessionModel {
 
   // =attributes
 
+  @attr('string', { readOnly: true }) proxy_address;
+  @attr('number', { readOnly: true }) proxy_port;
+
+  @equal('status', 'active') isActive;
+  @equal('status', 'pending') isPending;
+
   /**
    * @type {boolean}
    */
-  @computed('status')
+  @computed('isActive', 'isPending')
   get isCancelable() {
-    return this.status?.match(/(active)|(pending)/i);
+    return this.isActive || this.isPending;
+  }
+
+  /**
+   * The full proxy address and port if address exists, otherwise null.
+   * @type {?string}
+   */
+  @computed('proxy_address', 'proxy_port')
+  get proxy() {
+    return this.proxy_address
+      ? `${this.proxy_address}:${this.proxy_port}`
+      : null;
+  }
+
+  /**
+   * The target associated with this session (if loaded).
+   * @type {TargetModel}
+   */
+  get target() {
+    return this.store.peekRecord('target', this.target_id);
   }
 
   // =methods

addons/api/addon/models/target.js

@@ -36,6 +36,33 @@ export default class TargetModel extends GeneratedTargetModel {
       .filter((hostSetRef) => hostSetRef.model !== null);
   }
 
+  /**
+   * Sessions associated with this target (but only already loaded sessions).
+   * @type {SessionModel[]}
+   */
+  get sessions() {
+    return this.store.peekAll('session')
+      .filter(s => s && (s.target_id === this.id));
+  }
+
+  /**
+   * The project associated with this target (if already loaded).
+   * @type {ScopeModel}
+   */
+  get project() {
+    return this.store.peekRecord('scope', this.scopeID);
+  }
+
+  /**
+   * True if any sessions associated with this target are active or pending.
+   * @type {boolean}
+   */
+  get isActive() {
+    const pendingOrActiveSessions =
+      this.sessions.filter(s => s.isActive || s.isPending);
+    return Boolean(pendingOrActiveSessions.length);
+  }
+
   // =methods
 
   /**

addons/api/mirage/config.js

@@ -3,9 +3,12 @@ import config from '../config/environment';
 import { authHandler, deauthHandler } from './route-handlers/auth';
 import { pickRandomStatusString } from './factories/session';
 import { Response } from 'miragejs';
+import initializeMockIPC from './scenarios/ipc';
 
 export default function() {
 
+  initializeMockIPC(this);
+
   // make this `http://localhost:8080`, for example, if your API is on a different server
   // this.urlPrefix = '';
   // make this `/api`, for example, if your API is namespaced
@@ -20,13 +23,16 @@ export default function() {
 
   // Scope resources
 
-  this.get('/scopes', ({ scopes }, { queryParams: { scope_id } }) => {
+  this.get('/scopes', ({ scopes }, { queryParams: { scope_id, recursive } }) => {
     // Default parent scope is global
     if (!scope_id) scope_id = 'global';
-    const results = scopes.where(scope => {
-      return scope.scope ? scope.scope.id === scope_id : false
-    });
-    return results;
+    if (recursive && scope_id === 'global') {
+      return scopes.all();
+    } else {
+      return scopes.where(scope => {
+        return scope.scope ? scope.scope.id === scope_id : false
+      });
+    }
   });
   this.post('/scopes', function ({ scopes }) {
     // Parent scope comes through the payload via `scope_id`, but this needs
@@ -284,7 +290,16 @@ export default function() {
 
   // target
 
-  this.get('/targets', function ({ targets }, { queryParams: { scope_id } }) {
+  this.get('/targets', function ({ targets }, { queryParams: { scope_id, recursive } }) {
+    if (recursive && scope_id === 'global') {
+      return targets.all();
+    } else if (recursive) {
+      return targets.where(target => {
+        const targetModel = targets.find(target.id);
+        return (target.scopeId === scope_id)
+          || (targetModel?.scope?.scope?.id === scope_id)
+      });
+    }
     return targets.where(target => target.scopeId === scope_id);
   });
   this.post('/targets', function ({ targets }) {
@@ -322,19 +337,35 @@ export default function() {
 
   // session
 
-  this.get('/sessions', function ({ sessions }, { queryParams: { scope_id } }) {
+  this.get('/sessions', function ({ sessions }, { queryParams: { scope_id, recursive } }) {
     // To simulate changes to `session.status` that may occur in the backend,
     // we quietly randomize the value of the field on GET.
+    // To populate sessions for logged in user,
+    // update alternate sessions to auth user.
     // But only if not in testing mode.
     // In tests, we need deterministic statuses.
     if (!Ember.testing) {
-      sessions.where(session => session.scopeId === scope_id)
+      sessions.all()
         .models
-        .forEach(session => session.update({
-          status: pickRandomStatusString()
-        }));
+        .forEach(session => {
+          session.update({
+            status: pickRandomStatusString()
+          });
+          if(session.id.split('-').pop() % 2) session.update({
+            userId: 'authenticateduser'
+          });
+        });
     }
-    return sessions.where(session => session.scopeId === scope_id)
+    if (recursive && scope_id === 'global') {
+      return sessions.all();
+    } else if (recursive) {
+      return sessions.where(session => {
+        const sessionModel = sessions.find(session.id);
+        return (session.scopeId === scope_id)
+          || (sessionModel?.scope?.scope?.id === scope_id)
+      });
+    }
+    return sessions.where(session => session.scopeId === scope_id);
   });
   this.get('/sessions/:id', function ({ sessions }, { params: { id } }) {
     const session = sessions.find(id);

addons/api/mirage/factories/session.js

@@ -1,4 +1,4 @@
-import factory from '../generated/factories/target';
+import factory from '../generated/factories/session';
 import { trait } from 'ember-cli-mirage';
 import { random } from 'faker';
 
@@ -26,8 +26,7 @@ export default factory.extend({
       const scopeId = record.scopeId;
       if (record.scope.type === 'project') {
         const orgScopeId = record.scope?.scope.id;
-        const user =
-          server.schema.users.where({ scopeId: orgScopeId }).models[0];
+        const user = server.schema.users.where({ scopeId: orgScopeId }).models[0];
         if (user) record.update({ user });
       }
       const target = server.schema.targets.where({ scopeId }).models[0];

addons/api/mirage/scenarios/default.js

@@ -13,6 +13,8 @@ export default function(server) {
     scope: { id: globalScope.id, type: globalScope.type }
   }, 'withChildren')[0];
 
+  server.create('user', { id: 'authenticateduser' });
+
   // Auth
   server.createList('auth-method', 2, { scope: globalScope }, 'withAccountsAndUsers');
   server.createList('auth-method', 3, { scope: orgScope }, 'withAccountsAndUsers');
@@ -30,5 +32,4 @@ export default function(server) {
     server.createList('target', 2, { scope }, 'withRandomHostSets');
     server.createList('session', 4, { scope }, 'withAssociations');
   });
-
 }

addons/api/mirage/scenarios/ipc.js

@@ -0,0 +1,84 @@
+import Ember from 'ember';
+import config from 'ember-get-config';
+import { random } from 'faker';
+
+export default function initializeMockIPC (server) {
+  /**
+   * We strive to make this application runnable in a regular web browser, since
+   * it is a convenient environment for development and testing.  But only an
+   * Electron environment has true IPC.  Outside of Electron, we mock the handling
+   * of the message-based IPC requests originating from the
+   * renderer (the Ember app).
+   */
+  class MockIPC {
+    async invoke(method, payload) {
+      return await this[method](payload);
+    }
+
+    origin = null;
+
+    getOrigin() {
+      return this.origin;
+    }
+
+    setOrigin(origin) {
+      this.origin = origin;
+      return this.origin;
+    }
+
+    resetOrigin() {
+      this.origin = null;
+    }
+
+    openExternal(href) {
+      window.open(href);
+    }
+
+    cliExists() {
+      return true;
+    }
+
+    /**
+     * Creates a new session instance associated with the specified target.
+     * @param connect_details
+     * @param
+     */
+    connect({ target_id }) {
+      const target = server.schema.targets.find(target_id);
+      const { scope, type } = target;
+      const newSession = server.schema.sessions.create({
+        scope,
+        target,
+        userId: 'authenticateduser',
+        type,
+        created_time: new Date().toISOString()
+      });
+      return {
+        address: window.location.hostname,
+        port: random.number(),
+        protocol: type,
+        session_id: newSession.id
+      };
+    }
+  }
+
+  /**
+   * Establishes a mock IPC handler, which mimics the behavior of the Electron
+   * main process, and routes messages to it in a way similar to our
+   * preload.js script.
+   *
+   * Initializes mock IPC only in a non-Electron non-testing context.
+   */
+  if (!config.isElectron && !Ember.testing) {
+    const mockIPC = new MockIPC();
+    window.addEventListener('message', async function (event) {
+      if (event.origin !== window.location.origin) return;
+      const { method, payload } = event?.data ?? {};
+      if (method) {
+        const response = await mockIPC.invoke(method, payload);
+        event.ports[0].postMessage(response);
+      }
+    });
+  }
+
+}

addons/api/package.json

@@ -44,7 +44,7 @@
     "ember-copy": "^1.0.0",
     "ember-disable-prototype-extensions": "^1.1.3",
     "ember-export-application-global": "^2.0.1",
-    "ember-get-config": "^0.2.4",
+    "ember-get-config": "^0.3.0",
     "ember-load-initializers": "^2.1.1",
     "ember-maybe-import-regenerator": "^0.1.6",
     "ember-qunit": "^4.6.0",

addons/api/tests/unit/models/session-test.js

@@ -26,4 +26,37 @@ module('Unit | Model | session', function(hooks) {
     });
     assert.ok(model.isCancelable);
   });
+
+  test('it computes isActive', function (assert) {
+    assert.expect(2);
+    let store = this.owner.lookup('service:store');
+    let model = store.createRecord('session', {
+      status: 'pending'
+    });
+    assert.notOk(model.isActive);
+    model.status = 'active';
+    assert.ok(model.isActive);
+  });
+
+  test('it computes isPending', function (assert) {
+    assert.expect(2);
+    let store = this.owner.lookup('service:store');
+    let model = store.createRecord('session', {
+      status: 'active'
+    });
+    assert.notOk(model.isPending);
+    model.status = 'pending';
+    assert.ok(model.isPending);
+  });
+
+  test('it computes a proxy attribute', function (assert) {
+    let store = this.owner.lookup('service:store');
+    let model = store.createRecord('session');
+    assert.equal(model.proxy, null);
+    model.setProperties({
+      proxy_address: 'localhost',
+      proxy_port: '12345'
+    });
+    assert.equal(model.proxy, 'localhost:12345');
+  });
 });

addons/api/tests/unit/models/target-test.js

@@ -179,4 +179,44 @@ module('Unit | Model | target', function (hooks) {
     const model = store.peekRecord('target', '123abc');
     await model.removeHostSet('3');
   });
+
+  test('it has a `sessions` array of session instances associated with the target (if those instances are already in the store)', function (assert) {
+    assert.expect(3);
+    const store = this.owner.lookup('service:store');
+    store.push({
+      data: {
+        id: '123abc',
+        type: 'target'
+      }
+    });
+    const target = store.peekRecord('target', '123abc');
+    assert.equal( target.sessions.length, 0);
+    store.push({
+      data: {
+        id: '1',
+        type: 'session',
+        attributes: { target_id: '123abc' }
+      }
+    });
+    store.push({
+      data: {
+        id: '2',
+        type: 'session',
+        attributes: { target_id: '123abc' }
+      }
+    });
+    store.push({
+      data: {
+        id: '3',
+        type: 'session',
+        attributes: { target_id: '456xyz' }
+      }
+    });
+    assert.equal(store.peekAll('session').length, 3, 'There are 3 sessions loaded in the store');
+    assert.equal(
+      target.sessions.length,
+      2,
+      'Target has two associated sessions loaded in the store'
+    );
+  });
 });

addons/core/package.json

@@ -27,13 +27,14 @@
   "dependencies": {
     "api": "*",
     "auth": "*",
-    "rose": "*",
     "ember-cli-babel": "^7.21.0",
     "ember-cli-htmlbars": "^5.2.0",
+    "ember-get-config": "^0.3.0",
     "ember-intl": "^5.5.0",
-    "ember-page-title": "^6.0.3",
     "ember-loading": "^0.4.0",
-    "ember-route-action-helper": "^2.0.8"
+    "ember-page-title": "^6.0.3",
+    "ember-route-action-helper": "^2.0.8",
+    "rose": "*"
   },
   "devDependencies": {
     "@ember/optional-features": "^1.3.0",
@@ -50,7 +51,6 @@
     "ember-cli-uglify": "^3.0.0",
     "ember-disable-prototype-extensions": "^1.1.3",
     "ember-export-application-global": "^2.0.1",
-    "ember-get-config": "^0.3.0",
     "ember-inline-svg": "^1.0.0",
     "ember-intl": "^5.5.0",
     "ember-load-initializers": "^2.1.1",

addons/core/tests/integration/components/error/message-test.js

@@ -60,7 +60,7 @@ module('Integration | Component | error/message', function (hooks) {
     );
     assert.equal(
       find('.rose-message-description').textContent.trim(),
-      'Please contact your administrator or try again later.'
+      'We\'re not sure what happened.  Please contact your administrator or try again later.'
     );
   });
 });

addons/core/tests/unit/authenticators/password-test.js

@@ -44,6 +44,7 @@ module('Unit | Authenticator | password', function (hooks) {
     const authMethod = { id: 'paum_1234' };
     this.server.create('scope', { id: 'global', type: 'global' });
     this.server.create('auth-method', { id: authMethod.id, scopeId: 'global' });
+    this.server.create('user', { scopeId: 'global' });
     await authenticator.authenticate(creds, null, { scope, authMethod });
     assert.equal(
       applicationAdapter.headers.Authorization,

addons/core/translations/actions/en-us.yaml

@@ -3,6 +3,7 @@ cancel: Cancel
 delete: Delete
 remove: Remove
 discard: Discard
+disconnect: Disconnect
 dismiss: Dismiss
 save: Save
 submit: Submit

addons/core/translations/errors/en-us.yaml

@@ -12,8 +12,10 @@
   description: We ran into a problem and could not continue. You can ask your administrator or try again later.
 unknown:
   title: Something went wrong
-  description: Please contact your administrator or try again later.
+  description: We're not sure what happened.  Please contact your administrator or try again later.
 generic:
   title: Error
 authentication-failed:
   title: Authentication Failed
+origin-verification-failed:
+  description: Unable to connect to the specified origin. Please check the URL and try again.

addons/core/translations/form/en-us.yaml

@@ -49,3 +49,5 @@ grant_scope:
 origin:
   label: Origin URL
   description: The Boundary URL to which to connect (e.g. protocol://host:port)
+proxy:
+  label: Proxy

addons/core/translations/resources/en-us.yaml

@@ -95,6 +95,9 @@ host:
     none:
       title: No Hosts
       description: No hosts available in this scope.
+    none-friendly:
+      title: No Hosts Available
+      description: No hosts available to display yet.
   actions:
     add: Add Host
     create: New Host
@@ -104,11 +107,18 @@ host:
 session:
   title: Session
   title_plural: Sessions
+  active_plural: Active Sessions
   description: A session is a connection to a target initiated through Boundary.
   messages:
     none:
       title: No Sessions
       description: There are no active sessions within the current scope.
+    none-friendly:
+      title: No Sessions Available
+      description: No sessions available to display yet.
+    none-active-friendly:
+      title: No Active Sessions Available
+      description: No active sessions available to display yet.
   actions:
     connect: Connect
 org:
@@ -194,6 +204,9 @@ target:
   messages:
     welcome:
       title: Welcome to Targets
+    none:
+      title: No Targets Available
+      description: No Targets to display yet. Contact your Boundary admin if you don't see a Target you expect access to.
   actions:
     create: New Target
     delete: Delete Target

addons/core/translations/states/en-us.yaml

@@ -1,3 +1,4 @@
+active: Active
 info: Info
 success: Success
 warning: Warning

ui/admin/app/routes/scopes/scope.js

@@ -67,20 +67,31 @@ export default class ScopesScopeRoute extends Route {
     this.scope.org = selectedOrg;
     this.scope.project = selectedProject;
     this.scopes = { orgs, projects, selectedOrg, selectedProject };
+    // Update the controller (if exists), since setupController is only
+    // called once the first time the route is activated.  It is not called
+    // again on route refreshes.
+    if (this.controller) this.setControllerProperties(this.scopes);
   }
 
   /**
    * Adds the scopes hash to the controller context (see `afterModel`).
    * @param {Controller} controller
    */
-  setupController(controller) {
+  setupController(/* controller */) {
     super.setupController(...arguments);
-    const scopes = this.scopes;
-    controller.setProperties({ scopes });
+    this.setControllerProperties(this.scopes);
   }
 
   /**
-   * Renders the scope-specific sidebar template.
+   * Updates the controller's `scopes`.
+   * @param {array} scopes
+   */
+  setControllerProperties(scopes) {
+    this.controller.setProperties({ scopes });
+  }
+
+  /**
+   * Renders the scope-specific header template.
    * @override
    * @param {object} controller
    * @param {object} model

ui/admin/app/templates/scopes/scope/auth-methods/index.hbs

@@ -77,7 +77,9 @@
           <message.description>
             {{t 'resources.auth-method.messages.welcome.description'}}
           </message.description>
-          <message.link @route="scopes.scope.auth-methods.new">
+          <message.link
+            @route="scopes.scope.auth-methods.new"
+            @query={{hash type="password"}}>
             <Rose::Icon @name="plus-circle-outline" />
             {{t 'titles.new'}}
           </message.link>

ui/admin/app/templates/scopes/scope/authenticate/method/oidc.hbs

@@ -1 +1 @@
-Checking for OIDC ready …
+{{! Checking for OIDC ready … }}

ui/desktop/README.md

@@ -62,19 +62,26 @@ List of available project commands.  `yarn run <command-name>`
 To run as a desktop app:
 * `yarn start:desktop`
 
+The Boundary CLI is downloaded and extracted to `electron-app/cli/` folder as part of
+build. CLI version is defined in `electron-app/config/cli.js`.
+
 ### Building for Production
 
 Before executing a build, be sure to set any environment variables necessary
 for your target [environment](#environment-variables).  To build this UI for
-production, run the following commads from this folder:
+production, run the following commands from this folder:
 
 ```bash
 yarn install
 yarn build
 ```
 
-The static production assets are saved into the `dist/` folder.
+`BOUNDARY_DESKTOP_SIGNING_IDENTITY` environment variable must be provided
+to codesign in production.
 
+The static production assets are saved into the `dist/` folder.
+The Boundary CLI is downloaded and extracted to `electron-app/cli/` folder as part of
+packaging. CLI version is defined in `electron-app/config/cli.js`.
 
 #### Environment Variables
 
@@ -83,7 +90,7 @@ These environment variables may be used to customized the build.
 | Variable | Default Value | Description |
 | -------- | ------------- | ----------- |
 | `APP_NAME` | Application Name | The user-facing name of the application, appearing in titles, etc. |
-| `API_HOST` | | The host of the API, if different than UI (e.g. https://example.net:1234). |
+| `BOUNDARY_DESKTOP_SIGNING_IDENTITY` | | The name of the certificate to use when signing (e.g. Developer ID Application: * (*)). |
 
 ### Running Tests
 

ui/desktop/app/components/copyable/index.hbs

@@ -0,0 +1,30 @@
+<span
+  id={{this.id}}
+  class="copyable"
+  {{did-insert this.register}}
+  {{will-destroy this.destroy}}
+>
+
+  {{#if this.copied}}
+    <mark class="copyable-content">
+      {{yield}}
+    </mark>
+  {{else}}
+    <span class="copyable-content">
+      {{yield}}
+    </span>
+  {{/if}}
+
+  {{#if this.isClipboardLibrarySupported}}
+    <Rose::Button
+      id={{this.copyableButtonId}}
+      aria-describedby={{this.id}}
+      class="copyable-button"
+      @style="ghost"
+      @iconOnly={{if this.copied this.successIcon this.actionIcon}}
+      title={{if this.copied this.successText this.actionText}}
+    >
+      {{this.actionText}}
+    </Rose::Button>
+  {{/if}}
+</span>

ui/desktop/app/components/copyable/index.js

@@ -0,0 +1,98 @@
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { getOwner } from '@ember/application';
+import { generateComponentID } from 'rose/utilities/component-auto-id';
+import { task, timeout } from 'ember-concurrency';
+import { tracked } from '@glimmer/tracking';
+import ClipboardJS from 'clipboard';
+
+export default class CopyableComponent extends Component {
+
+  // =attributes
+
+  id = generateComponentID();
+  copyableButtonId = `copyable-button-${this.id}`;
+
+  actionIcon = 'copy-action';
+  successIcon = 'copy-success';
+  actionText = this.args.buttonText;
+  successText = this.args.acknowledgeText;
+
+  @tracked copied = false;
+
+  clipboard = null;
+
+  /**
+   * A Ember Concurrency-based task that updates copy icon to a success state
+   * and back after 1 second. This icon flash indicates success on
+   * copy to clipboard action.
+   *
+   * NOTE:  tasks are sort of attributes and sort of methods, but they are not
+   * language-level constructs.  Thus we annotate this task as if it
+   * is an attribute.
+   * @type {Task}
+   */
+  /* istanbul ignore next */
+  @task(function * () {
+    this.copied = true;
+    yield timeout(1000);
+    this.copied = false;
+  }).drop() confirmCopyTimer;
+
+  /**
+   * Checks for ClipboardJS support.
+   * @return {boolean}
+   */
+  get isClipboardLibrarySupported() {
+    return ClipboardJS.isSupported();
+  }
+
+  // =methods
+
+  /**
+   * Returns the first element with the specified class name if exists,
+   * otherwise undefined.
+   * @return {?HTMLElement}
+   */
+  getFirstElementByClassName(className) {
+    const document = getOwner(this).lookup('service:-document').documentElement;
+    return document.getElementsByClassName(className)[0];
+  }
+
+  // =actions
+
+  /**
+   * Initialize ClipboardJS library and register for it's events.
+   */
+  @action
+  register() {
+    this.destroy();
+    /* istanbul ignore next */
+    this.clipboard = new ClipboardJS(`#${this.copyableButtonId}`, {
+      text: () => this.args.text,
+      // ClipboardJS depends on inserting a hidden textarea that receives
+      // focus in order to copy text to the clipboard.  However, our modal
+      // has a focus trap that prevents this focus.  Thus we try to set the
+      // container to a modal (if exists), since this is the only container
+      // a user would be able to interact with.  If a modal doesn't exist,
+      // container is set to `undefined` and thus uses the default body element.
+      container: this.getFirstElementByClassName('rose-dialog')
+    });
+    /* istanbul ignore next */
+    this.clipboard.on('success', (clipboardEvent) => {
+      clipboardEvent.clearSelection();
+      this.confirmCopyTimer.perform();
+    });
+  }
+
+  /**
+   * Destroy ClipboardJS library instance and cancel icon timer.
+   */
+  @action
+  destroy() {
+    this.clipboard?.destroy();
+    this.clipboard = null;
+    this.confirmCopyTimer.cancelAll();
+  }
+
+}

ui/desktop/app/controllers/scopes/scope/projects/sessions/index.js

@@ -0,0 +1,33 @@
+import Controller from '@ember/controller';
+import { inject as service } from '@ember/service';
+
+export default class ScopesScopeProjectsSessionsIndexController extends Controller {
+
+  // =sessions
+
+  @service session;
+
+  // =attributes
+
+  /**
+   * A list of sessions filtered to the current user and sorted by created time,
+   * and active/pending.
+   * @type {SessionModel[]}
+   */
+  get sorted() {
+    const userId = this.session.data.authenticated.user_id;
+    const sessions = this.model;
+    const sortedSessions = sessions
+      // filter sessions by current user
+      .filter(session => session.user_id === userId)
+      // sort by created time
+      .sortBy('session.created_time').reverse();
+    return [
+      // then move active sessions to the top
+      ...sortedSessions.filter((session) => session.isCancelable),
+      // and all others to the end
+      ...sortedSessions.filter((session) => !session.isCancelable),
+    ];
+  }
+
+}

ui/desktop/app/controllers/scopes/scope/projects/targets/target/sessions.js

@@ -0,0 +1,38 @@
+import Controller from '@ember/controller';
+import { inject as service } from '@ember/service';
+import { A } from '@ember/array';
+
+export default class ScopesScopeProjectsTargetsTargetSessionsController extends Controller {
+  // =services
+
+  @service session;
+
+  /**
+   * Sessions belonging to the target.
+   * @type {SessionModel[]}
+   */
+  get sessions() {
+    return this.model.sessions;
+  }
+
+  /**
+   * Sort and filter to active sessions of current user.
+   * @param {[SessionModel]} model
+   * @param {object} session
+   * @type {[SessionModel]}
+   */
+  get cancelableUserSessions() {
+    const sessions = this.sessions;
+    const userId = this.session.data.authenticated.user_id;
+    const filteredSessions =
+      sessions.filter(session =>
+        session.isCancelable &&
+        session.user_id === userId
+      );
+
+    // Sort sessions
+    const sortedSessions = A(filteredSessions).sortBy('created_time').reverse();
+
+    return sortedSessions;
+  }
+}

ui/desktop/app/initializers/ipc.js

@@ -1,52 +0,0 @@
-import Ember from 'ember';
-import config from '../config/environment';
-
-/**
- * We strive to make this application runnable in a regular web browser, since
- * it is a convenient environment for development and testing.  But only an
- * Electron environment has true IPC.  Outside of Electron, we mock the handling
- * of the message-based IPC requests originating from the
- * renderer (the Ember app).
- */
-class MockIPC {
-  async invoke(method, payload) {
-    console.log('MockIPC:', method, payload);
-    return await this[method](payload);
-  }
-
-  origin = null;
-
-  getOrigin() {
-    return this.origin;
-  }
-
-  setOrigin(origin) {
-    this.origin = origin;
-    return this.origin;
-  }
-
-  connect() {}
-}
-
-/**
- * Establishes a mock IPC handler, which mimics the behavior of the Electron
- * main process, and routes messages to it in a way similar to our
- * preload.js script.
- *
- * Initializes mock IPC only in a non-Electron non-testing context.
- */
-export function initialize() {
-  if (!config.isElectron && !Ember.testing) {
-    const mockIPC = new MockIPC();
-    window.addEventListener('message', async function (event) {
-      if (event.origin !== window.location.origin) return;
-      const { method, payload } = event?.data ?? {};
-      if (method) {
-        const response = await mockIPC.invoke(method, payload);
-        event.ports[0].postMessage(response);
-      }
-    });
-  }
-}
-
-export default { initialize };

ui/desktop/app/router.js

@@ -13,7 +13,13 @@ Router.map(function () {
         this.route('method', { path: ':auth_method_id' });
       });
       this.route('projects', function () {
-        this.route('targets', function () {});
+        this.route('targets', function () {
+          this.route('target', { path: ':target_id' }, function() {
+            this.route('hosts');
+            this.route('sessions');
+          });
+        });
+        this.route('sessions', function() {});
       });
     });
   });

ui/desktop/app/routes/application.js

@@ -1,5 +1,6 @@
 import Route from '@ember/routing/route';
 import Ember from 'ember';
+import jQuery from 'jquery';
 /* eslint-disable-next-line ember/no-mixins */
 import ApplicationRouteMixin from 'ember-simple-auth/mixins/application-route-mixin';
 import { inject as service } from '@ember/service';
@@ -16,6 +17,7 @@ export default class ApplicationRoute extends Route.extend(
 
   @service session;
   @service origin;
+  @service ipc;
 
   // =attributes
 
@@ -30,9 +32,23 @@ export default class ApplicationRoute extends Route.extend(
    * origin so that the renderer's CSP can be rewritten to allow requests.
    */
   beforeModel() {
+    const theme = this.session.get('data.theme');
+    this.toggleTheme(theme);
     return this.origin.updateOrigin();
   }
 
+  /**
+   * Adds listener on target=_blank links so that they may be opened in an
+   * external browser.
+   */
+  afterModel() {
+    const ipc = this.ipc;
+    /* eslint-disable-next-line ember/no-jquery */
+    jQuery(document).on('click', 'a[href][target="_blank"]', function () {
+      ipc.invoke('openExternal', this.href);
+    });
+  }
+
   /**
    * After becoming authenticated, does nothing.  This overrides the default
    * behavior of the ApplicationRouteMixin, which is to redirect after auth.
@@ -71,6 +87,16 @@ export default class ApplicationRoute extends Route.extend(
     this.session.invalidate();
   }
 
+  /**
+   * Disconnects from origin and invalidates session, thereby resetting
+   * the client and reloading to the onboarding origin screen.
+   */
+  @action
+  disconnect() {
+    this.origin.resetOrigin();
+    this.invalidateSession();
+  }
+
   /**
    * Hooks into ember-loading to kick off loading indicator in the
    * application template.
@@ -98,4 +124,30 @@ export default class ApplicationRoute extends Route.extend(
     }
     return true;
   }
+
+  /**
+   * Applies the specified color theme to the root ember element.
+   * @param {string} theme - "light", "dark", or nullish (system default)
+   */
+  @action
+  toggleTheme(theme) {
+    const rootElementSelector = getOwner(this).rootElement;
+    const rootEl = getOwner(this)
+      .lookup('service:-document')
+      .querySelector(rootElementSelector);
+    this.session.set('data.theme', theme);
+    switch (theme) {
+      case 'light':
+        rootEl.classList.add('rose-theme-light');
+        rootEl.classList.remove('rose-theme-dark');
+        break;
+      case 'dark':
+        rootEl.classList.add('rose-theme-dark');
+        rootEl.classList.remove('rose-theme-light');
+        break;
+      default:
+        rootEl.classList.remove('rose-theme-dark');
+        rootEl.classList.remove('rose-theme-light');
+    }
+  }
 }

ui/desktop/app/routes/scopes/scope.js

@@ -88,15 +88,4 @@ export default class ScopesScopeRoute extends Route {
       outlet: 'header-nav',
     });
   }
-
-  /**
-   * In global scope, redirect to first org on authentication.
-   */
-  redirect(model) {
-    const { isAuthenticated } = this.session;
-    const { isGlobal } = model;
-    if (isAuthenticated && isGlobal && this.scopes.orgs?.length) {
-      this.replaceWith('scopes.scope', this.scopes.orgs.firstObject.id);
-    }
-  }
 }

ui/desktop/app/routes/scopes/scope/projects.js

@@ -1,6 +1,20 @@
 import Route from '@ember/routing/route';
 import { inject as service } from '@ember/service';
 
+/**
+ * TODO:  This route is now vestigial.  Desktop does not provide project-based
+ * navigation.  This route formerly provided a way to aggregate
+ * all project scopes, which was necessary to then aggregate targets and
+ * sessions under those projects.  Since the API now provides recursive listing,
+ * it's possible to load all targets and sessions with a single call, no client-
+ * side aggregation required.
+ *
+ * However, it _is_ necessary to prime the store with all project scopes.
+ * This allows the UI to display project names on associated resources.
+ *
+ * The priming function of this route could be moved to scopes or scopes/scope.
+ * It no longer makes sense as a dedicated route.
+ */
 export default class ScopesScopeProjectsRoute extends Route {
   // =services
 
@@ -16,13 +30,13 @@ export default class ScopesScopeProjectsRoute extends Route {
   }
 
   /**
-   * Loads project scopes for the current scope.
-   * @return {Promise
+   * Primes the store with _all project scopes_ under global.
+   * @return {Promise{ScopeModel}}
    */
   model() {
-    const currentScope = this.modelFor('scopes.scope');
-    return this.store.query('scope', {
-      scope_id: currentScope.id,
-    });
+    return this.store
+      .query('scope', { recursive: true, scope_id: 'global' })
+      .filter(({ isProject }) => isProject);
   }
+
 }

ui/desktop/app/routes/scopes/scope/projects/sessions.js

@@ -0,0 +1,81 @@
+import Route from '@ember/routing/route';
+import { inject as service } from '@ember/service';
+import { task, timeout } from 'ember-concurrency';
+import config from '../../../../config/environment';
+import { action } from '@ember/object';
+import { notifySuccess, notifyError } from 'core/decorators/notify';
+
+const POLL_TIMEOUT_SECONDS = config.sessionPollingTimeoutSeconds;
+
+export default class ScopesScopeProjectsSessionsRoute extends Route {
+
+  // =services
+
+  @service session;
+
+  // =attributes
+
+  /**
+   * A simple Ember Concurrency-based polling task that refreshes the route
+   * every POLL_TIMEOUT_SECONDS seconds.  This is necessary to display changes
+   * to session `status` that may occur.
+   *
+   * NOTE:  tasks are sort of attributes and sort of methods, but they are not
+   * language-level constructs.  Thus we annotate this task as if it
+   * is an attribute.
+   * @type {Task}
+   */
+  @task(function * () {
+    while(true) {
+      yield timeout(POLL_TIMEOUT_SECONDS * 1000);
+      yield this.refresh();
+    }
+  }).drop() poller;
+
+  // =methods
+
+  /**
+   * If arriving here unauthenticated, redirect to index for further processing.
+   */
+  beforeModel() {
+    if (!this.session.isAuthenticated) this.transitionTo('index');
+  }
+
+  /**
+   * Loads all sessions under the current scope and encapsulates them into
+   * an array of objects filtering to current user
+   * @return {Promise{[{session: SessionModel, target: TargetModel}]}}
+   */
+  async model() {
+    const { id: scope_id } = this.modelFor('scopes.scope');
+    await this.store.query('target', { recursive: true, scope_id });
+    return await this.store.query('session', { recursive: true, scope_id });
+  }
+
+  /**
+   * When this route is activated (entered), begin polling for changes.
+   */
+  activate() {
+    this.poller.perform();
+  }
+
+  /**
+   * When this route is deactivated (exited), stop polling for changes.
+   */
+  deactivate() {
+    this.poller.cancelAll();
+  }
+
+  // =actions
+
+  /**
+   * Cancels the specified session and notifies user of success or error.
+   * @param {SessionModel}
+   */
+  @action
+  @notifyError(({ message }) => message, { catch: true })
+  @notifySuccess('notifications.canceled-success')
+  async cancelSession(session) {
+    await session.cancelSession();
+  }
+}

ui/desktop/app/routes/scopes/scope/projects/sessions/index.js

@@ -0,0 +1,4 @@
+import Route from '@ember/routing/route';
+
+export default class ScopesScopeProjectsSessionsIndexRoute extends Route {
+}

ui/desktop/app/routes/scopes/scope/projects/targets.js

@@ -1,9 +1,14 @@
 import Route from '@ember/routing/route';
 import { inject as service } from '@ember/service';
-import { all } from 'rsvp';
 import { action } from '@ember/object';
+import { task, timeout } from 'ember-concurrency';
+import { later } from '@ember/runloop';
+import config from '../../../../config/environment';
+
+const POLL_TIMEOUT_SECONDS = config.sessionPollingTimeoutSeconds;
 
 export default class ScopesScopeProjectsTargetsRoute extends Route {
+
   // =services
 
   @service ipc;
@@ -12,6 +17,25 @@ export default class ScopesScopeProjectsTargetsRoute extends Route {
   @service notify;
   @service confirm;
 
+  // =attributes
+
+  /**
+   * A simple Ember Concurrency-based polling task that refreshes the route
+   * every POLL_TIMEOUT_SECONDS seconds.  This is necessary to display changes
+   * to session `status` that may occur.
+   *
+   * NOTE:  tasks are sort of attributes and sort of methods, but they are not
+   * language-level constructs.  Thus we annotate this task as if it
+   * is an attribute.
+   * @type {Task}
+   */
+  @task(function * () {
+    while(true) {
+      yield timeout(POLL_TIMEOUT_SECONDS * 1000);
+      yield this.refreshSessions();
+    }
+  }).drop() poller;
+
   // =methods
 
   /**
@@ -26,44 +50,86 @@ export default class ScopesScopeProjectsTargetsRoute extends Route {
    * @return {Promise{[TargetModel]}}
    */
   async model() {
-    const projects = this.modelFor('scopes.scope.projects');
-    let projectTargets = await all(
-      projects.map(({ id: scope_id }) =>
-        this.store.query('target', { scope_id })
-      )
-    );
-    let targets = projectTargets.map((target) => target.toArray()).flat();
-    return targets.map((target) => {
-      return {
-        target,
-        project: this.store.peekRecord('scope', target.scopeID),
-      };
-    });
+    const { id: scope_id } = this.modelFor('scopes.scope');
+    await this.refreshSessions();
+    return this.store.query('target', { recursive: true, scope_id });
+  }
+
+  /**
+   * Loads all sessions for all scopes in order to prime the store.
+   * Targets peek into the store to determine if they are active.
+   * TODO:  query only for sessions associated with the current user.
+   */
+  async refreshSessions() {
+    const { id: scope_id } = this.modelFor('scopes.scope');
+    await this.store.query('session', { recursive: true, scope_id });
+  }
+
+  /**
+   * When this route is activated (entered), begin polling for changes.
+   */
+  activate() {
+    this.poller.perform();
+  }
+
+  /**
+   * When this route is deactivated (exited), stop polling for changes.
+   */
+  deactivate() {
+    this.poller.cancelAll();
   }
 
   // =actions
 
   /**
    * Establish a session to current target.
+   * @param {TargetModel} model
+   * @param {HostModel} host
    */
   @action
-  async connect(model) {
+  async connect(model, host) {
+    // TODO: Connect: Refactor into an addon
     try {
-      //eslint-disable-next-line no-debugger
-      debugger;
-      // Check for cli
-      const cliPath = await this.ipc.invoke('cliExists');
-      if(!cliPath) throw new Error('Cannot find boundary cli.')
+      // Check for CLI
+      const cliExists = await this.ipc.invoke('cliExists');
+      if (!cliExists) throw new Error('Cannot find Boundary CLI.');
+
+      const options = {
+        target_id: model.id,
+        token: this.session.data.authenticated.token
+      };
+
+      if (host) options.host_id = host.id;
 
       // Create target session
-      const connectionDetails = await this.ipc.invoke('connect', {
-        target_id: model.target.id,
-        token: this.session.data.authenticated.token,
-        addr: this.origin.rendererOrigin
-      });
+      const connectionDetails = await this.ipc.invoke('connect', options);
+
+      // Associate the connection details with the session
+      const { session_id, address, port } = connectionDetails;
+      await this.store.findRecord('session', session_id);
+
+      // Update the session record with proxy information from the CLI
+      // This is read-only information that shouldn't dirty the session,
+      // so we use store.push here.  In the future, it may make sense to push
+      // this off to the API so that we don't have to manually persist the
+      // proxy details.
+      later(() => {
+        this.store.push({
+          data: {
+            id: session_id,
+            type: 'session',
+            attributes: {
+              proxy_address: address,
+              proxy_port: port
+            }
+          }
+        });
+      }, 150);
 
       // Show the user a modal with basic connection info.
+      // We don't await because this modal is purely informational.
       this.confirm.confirm(connectionDetails, { isConnectSuccess: true });
+
     } catch(e) {
       this.confirm.confirm(e.message, { isConnectError: true })
         // Retry

ui/desktop/app/routes/scopes/scope/projects/targets/target.js

@@ -0,0 +1,40 @@
+import Route from '@ember/routing/route';
+
+export default class ScopesScopeProjectsTargetsTargetRoute extends Route {
+
+  // =methods
+
+  /**
+   * Load a target
+   * @param {object} params
+   * @param {string} params.target_id
+   * @return {TargetModel}
+   */
+  model({ target_id }) {
+    return this.store.findRecord('target', target_id, { reload: true });
+  }
+
+  /**
+   * Renders the target-specific templates for actions, header and navigation
+   * page sections.
+   * @override
+   */
+  renderTemplate() {
+    super.renderTemplate(...arguments);
+
+    this.render('scopes/scope/projects/targets/target/-actions', {
+      into: 'scopes/scope/projects/targets/target',
+      outlet: 'actions',
+    });
+
+    this.render('scopes/scope/projects/targets/target/-header', {
+      into: 'scopes/scope/projects/targets/target',
+      outlet: 'header',
+    });
+
+    this.render('scopes/scope/projects/targets/target/-navigation', {
+      into: 'scopes/scope/projects/targets/target',
+      outlet: 'navigation',
+    });
+  }
+}

ui/desktop/app/routes/scopes/scope/projects/targets/target/hosts.js

@@ -0,0 +1,48 @@
+import Route from '@ember/routing/route';
+import { all, hash } from 'rsvp';
+import { inject as service } from '@ember/service';
+
+export default class ScopesScopeProjectsTargetsTargetHostsRoute extends Route {
+  // =services
+
+  @service ipc;
+  @service session;
+  @service origin;
+  @service notify;
+  @service confirm;
+
+  // =methods
+
+  /**
+   * Loads all host-sets and associated hosts under the current target.
+   * @return {Promise{[HostModel]}}
+   */
+  async model() {
+    const target = this.modelFor('scopes.scope.projects.targets.target');
+    // Load all host-sets
+    const hostSets = await all(
+      target.host_sets.map(({ host_set_id }) =>
+        this.store.findRecord('host-set', host_set_id)
+      )
+    );
+
+    // Extract host ids from all host sets
+    const hostIds = hostSets.map(({host_ids}) =>
+      host_ids.content.map((hostId) =>
+        hostId.value
+      )
+    )
+
+    // Load unique hosts
+    const uniqueHostIds = new Set(hostIds.flat());
+
+    return hash({
+      target,
+      hosts: all(
+        [...uniqueHostIds].map((hostId) =>
+          this.store.findRecord('host', hostId)
+        )
+      )
+    })
+  }
+}

ui/desktop/app/routes/scopes/scope/projects/targets/target/index.js

@@ -0,0 +1,13 @@
+import Route from '@ember/routing/route';
+
+export default class ScopesScopeProjectsTargetsTargetIndexRoute extends Route {
+  // =methods
+
+  /**
+   * Navigate to hosts within a target.
+   */
+  afterModel() {
+    this.transitionTo('scopes.scope.projects.targets.target.sessions');
+  }
+
+}

ui/desktop/app/routes/scopes/scope/projects/targets/target/sessions.js

@@ -0,0 +1,20 @@
+import Route from '@ember/routing/route';
+import { action } from '@ember/object';
+import { notifySuccess, notifyError } from 'core/decorators/notify';
+
+export default class ScopesScopeProjectsTargetsTargetSessionsRoute extends Route {
+
+  // =actions
+
+  /**
+   * Cancels the specified session and notifies user of success or error.
+   * @param {SessionModel}
+   */
+  @action
+  @notifyError(({ message }) => message, { catch: true })
+  @notifySuccess('notifications.canceled-success')
+  async cancelSession(session) {
+    await session.cancelSession();
+  }
+
+}

ui/desktop/app/services/origin.js

@@ -1,6 +1,7 @@
 import Service from '@ember/service';
 import { assert } from '@ember/debug';
 import { inject as service } from '@ember/service';
+import { notifyError } from 'core/decorators/notify';
 
 export default class OriginService extends Service {
 
@@ -72,4 +73,13 @@ export default class OriginService extends Service {
     }
   }
 
+  /**
+   * Resets the origin.
+   */
+  @notifyError(({ message }) => message, { catch: true })
+  async resetOrigin() {
+    this.rendererOrigin = null;
+    await this.ipc.invoke('resetOrigin');
+  }
+
 }

ui/desktop/app/styles/app.scss

@@ -105,10 +105,6 @@
   padding-left: sizing.rems(l) * 3;
   position: relative;
 
-  .rose-header-brand {
-    display: none;
-  }
-
   .logotype {
     display: none;
   }
@@ -171,7 +167,7 @@
       0% {
         background-color: var(--action-subtler-1);
       }
-
+      
       100% {
         background-color: transparent;
       }

ui/desktop/app/templates/application.hbs

@@ -22,6 +22,29 @@
             >
               {{t 'actions.deauthenticate'}}
             </dropdown.button>
+
+            <dropdown.separator />
+
+            <dropdown.section @title={{t "titles.toggle-color-theme"}}>
+              <Rose::Form as |form|>
+                <form.radioGroup
+                  @name="theme"
+                  @selectedValue={{this.session.data.theme}}
+                  @changed={{route-action "toggleTheme"}}
+                as |radioGroup|>
+                  <dropdown.item>
+                    <radioGroup.radio @label={{t "themes.system"}} />
+                  </dropdown.item>
+                  <dropdown.item>
+                    <radioGroup.radio @label={{t "themes.light"}} @value="light" />
+                  </dropdown.item>
+                  <dropdown.item>
+                    <radioGroup.radio @label={{t "themes.dark"}} @value="dark" />
+                  </dropdown.item>
+                </form.radioGroup>
+              </Rose::Form>
+            </dropdown.section>
+            
           </utilities.dropdown>
         </header.utilities>
       {{/if}}
@@ -54,14 +77,22 @@
       @icon="check-circle-fill"
       @style="success"
       @modal={{true}}
-      @dismiss={{accept}}
+      @dismiss={{deny}}
     as |dialog|>
       <dialog.body>
-        {{t 'states.connection.success.description'
-          port=confirmation.text.port
-          address=confirmation.text.address
-          protocol=confirmation.text.protocol
-        }}
+
+        <Copyable
+          @text={{concat confirmation.text.address ":" confirmation.text.port}}
+          @buttonText={{t "actions.copy-to-clipboard"}}
+          @acknowledgeText={{t "states.copied"}}
+        >
+          {{t 'states.connection.success.description'
+            port=confirmation.text.port
+            address=confirmation.text.address
+            protocol=confirmation.text.protocol
+          }}
+        </Copyable>
+
       </dialog.body>
       <dialog.footer>
         <Rose::Button @style="primary" {{on "click" accept}}>
@@ -76,7 +107,7 @@
       @icon="cancel-square-fill"
       @style="error"
       @modal={{true}}
-      @dismiss={{accept}}
+      @dismiss={{deny}}
     as |dialog|>
       <dialog.body>
         <p>

ui/desktop/app/templates/error.hbs

@@ -0,0 +1,15 @@
+{{page-title (t "errors.generic.title") }}
+
+<main>
+
+  <Rose::Layout::Centered>
+    <Error::Message />
+  </Rose::Layout::Centered>
+
+  <Rose::Layout::Centered>
+    <Rose::Button @style="primary" {{on "click" (route-action "disconnect")}}>
+      {{t "actions.disconnect"}}
+    </Rose::Button>
+  </Rose::Layout::Centered>
+
+</main>

ui/desktop/app/templates/scopes.hbs

@@ -1,5 +1 @@
-{{page-title (t 'resources.scope.title_plural')}}
-
-<main>
-  {{outlet}}
-</main>
+{{outlet}}

ui/desktop/app/templates/scopes/index.hbs

@@ -1,36 +1 @@
-<Rose::Layout::Page as |page|>
-
-  <page.header>
-    <h2>
-      {{t "resources.scope.title_plural"}}
-    </h2>
-  </page.header>
-
-  <page.body>
-    <Rose::Table as |table|>
-      <table.header as |header|>
-        <header.row as |row|>
-          <row.headerCell>{{t 'resources.scope.title'}}</row.headerCell>
-        </header.row>
-      </table.header>
-      <table.body as |body|>
-        {{#each @model as |scope|}}
-          <body.row as |row|>
-            <row.cell>
-              <Rose::LinkButton
-                @route="scopes.scope"
-                @model={{scope.id}}
-              >
-                {{scope.name}}
-              </Rose::LinkButton>
-            </row.cell>
-            <row.cell>
-              {{scope.id}}
-            </row.cell>
-          </body.row>
-        {{/each}}
-      </table.body>
-    </Rose::Table>
-  </page.body>
-
-</Rose::Layout::Page>
+{{outlet}}

ui/desktop/app/templates/scopes/scope.hbs

@@ -1 +1 @@
-{{outlet}}
+{{outlet}}

ui/desktop/app/templates/scopes/scope/authenticate.hbs

@@ -1,65 +1,58 @@
 {{page-title (t "actions.authenticate")}}
-{{!--
-<Rose::Form::Input
-  @type="text"
-  @name=""
-  @value={{this.origin.rendererOrigin}}
-  @label={{t "form.origin.label"}}
-  @disabled={{true}}
-  />
-<Rose::Button @style="ghost">Change</Rose::Button> --}}
 
-<BrandedCard
-  @title={{t 'actions.authenticate'}}
-  @description={{t 'auth.descriptions.authenticating-with-org' name=@model.scope.displayName}}
->
+<main>
+  <BrandedCard
+    @title={{t 'actions.authenticate'}}
+    @description={{t 'auth.descriptions.authenticating-with-org' name=@model.scope.displayName}}
+  >
 
-  <Rose::Dropdown
-    @text={{t "actions.choose-different-org"}}
-    @icon="user-organization"
-  as |dropdown|>
-    <dropdown.link @route="scopes.scope.authenticate" @model="global">
-      {{t "titles.global"}}
-    </dropdown.link>
-    {{#each this.sortedScopes as |scope|}}
-      <dropdown.link @route="scopes.scope.authenticate" @model={{scope.id}}>
-        {{scope.displayName}}
+    <Rose::Dropdown
+      @text={{t "actions.choose-different-org"}}
+      @icon="user-organization"
+    as |dropdown|>
+      <dropdown.link @route="scopes.scope.authenticate" @model="global">
+        {{t "titles.global"}}
       </dropdown.link>
-    {{/each}}
-  </Rose::Dropdown>
+      {{#each this.sortedScopes as |scope|}}
+        <dropdown.link @route="scopes.scope.authenticate" @model={{scope.id}}>
+          {{scope.displayName}}
+        </dropdown.link>
+      {{/each}}
+    </Rose::Dropdown>
 
-  <Rose::Nav::Tabs as |nav|>
-    {{#each @model.authMethods as |authMethod|}}
-      <nav.link @route="scopes.scope.authenticate.method" @model={{authMethod.id}}>
-        {{t (concat "resources.auth-method.types." authMethod.type)}}
-      </nav.link>
-    {{/each}}
-  </Rose::Nav::Tabs>
+    <Rose::Nav::Tabs as |nav|>
+      {{#each @model.authMethods as |authMethod|}}
+        <nav.link @route="scopes.scope.authenticate.method" @model={{authMethod.id}}>
+          {{t (concat "resources.auth-method.types." authMethod.type)}}
+        </nav.link>
+      {{/each}}
+    </Rose::Nav::Tabs>
 
-  {{#if @model.authMethods}}
-    {{outlet}}
+    {{#if @model.authMethods}}
+      {{outlet}}
 
-    <p class="change-origin">
-      {{t "origin.connected-to"}}:
-      <code>{{this.origin}}</code>
-      <br>
-      <LinkTo @route="origin">
-        {{t "actions.change-origin"}}
-      </LinkTo>
-    </p>
+      <p class="change-origin">
+        {{t "origin.connected-to"}}:
+        <code>{{this.origin}}</code>
+        <br>
+        <LinkTo @route="origin">
+          {{t "actions.change-origin"}}
+        </LinkTo>
+      </p>
 
-  {{/if}}
-  {{#unless @model.authMethods}}
-    <Rose::Layout::Centered>
-      <Rose::Message
-        @title={{t "resources.auth-method.messages.none.title"}}
-        @icon="alert-circle-outline"
-      as |message|>
-        <message.description>
-          {{t "resources.auth-method.messages.none.description"}}
-        </message.description>
-      </Rose::Message>
-    </Rose::Layout::Centered>
-  {{/unless}}
+    {{/if}}
+    {{#unless @model.authMethods}}
+      <Rose::Layout::Centered>
+        <Rose::Message
+          @title={{t "resources.auth-method.messages.none.title"}}
+          @icon="alert-circle-outline"
+        as |message|>
+          <message.description>
+            {{t "resources.auth-method.messages.none.description"}}
+          </message.description>
+        </Rose::Message>
+      </Rose::Layout::Centered>
+    {{/unless}}
 
-</BrandedCard>
+  </BrandedCard>
+</main>

ui/desktop/app/templates/scopes/scope/projects.hbs

@@ -1 +1,25 @@
-{{outlet}}
+<Rose::Layout::Sidebar as |sidebarLayout|>
+  <sidebarLayout.sidebar>
+    <Rose::Nav::Sidebar as |nav|>
+      <nav.link @route="scopes.scope.projects.targets">
+        <Rose::Icon
+          @name="app-icons/target"
+          @size="medium" />
+          {{t "resources.target.title_plural"}}
+      </nav.link>
+
+      <nav.link @route="scopes.scope.projects.sessions">
+        <Rose::Icon
+          @name="app-icons/action-session"
+          @size="medium" />
+          {{t "resources.session.title_plural"}}
+      </nav.link>
+    </Rose::Nav::Sidebar>
+  </sidebarLayout.sidebar>
+
+  <sidebarLayout.body>
+    <main>
+      {{outlet}}
+    </main>
+  </sidebarLayout.body>
+</Rose::Layout::Sidebar>

ui/desktop/app/templates/scopes/scope/projects/error.hbs

@@ -0,0 +1,23 @@
+{{page-title (t "errors.generic.title") }}
+
+{{! Most error types will land here }}
+{{#if @model.errors}}
+  <Rose::Layout::Centered>
+    {{#each @model.errors as |error|}}
+      <Error::Message @status={{error.status}}/>
+    {{/each}}
+  </Rose::Layout::Centered>
+{{/if}}
+
+{{! But a disconnected state doesn't get normalized errors }}
+{{#unless @model.errors}}
+  <Rose::Layout::Centered>
+    <Error::Message />
+  </Rose::Layout::Centered>
+
+  <Rose::Layout::Centered>
+    <Rose::Button @style="primary" {{on "click" (route-action "disconnect")}}>
+      {{t "actions.disconnect"}}
+    </Rose::Button>
+  </Rose::Layout::Centered>
+{{/unless}}

ui/desktop/app/templates/scopes/scope/projects/sessions.hbs

@@ -0,0 +1 @@
+{{outlet}}

ui/desktop/app/templates/scopes/scope/projects/sessions/index.hbs

@@ -0,0 +1,101 @@
+<Rose::Layout::Page as |page|>
+
+  <page.header>
+    <h2>
+      {{t "resources.session.title_plural"}}
+      <DocLink @doc="sessions" @iconSize="large" />
+    </h2>
+    <p>{{t "resources.session.description"}}</p>
+  </page.header>
+
+  <page.body>
+
+    {{#if this.sorted}}
+
+      <Rose::Table as |table|>
+        <table.header as |header|>
+          <header.row as |row|>
+            <row.headerCell>{{t "form.id.label"}}</row.headerCell>
+            <row.headerCell>{{t "resources.target.title"}}</row.headerCell>
+            <row.headerCell>{{t "form.proxy.label"}}</row.headerCell>
+            <row.headerCell>{{t "form.started.label"}}</row.headerCell>
+            <row.headerCell>{{t "form.status.label"}}</row.headerCell>
+            <row.headerCell />
+          </header.row>
+        </table.header>
+        <table.body as |body|>
+          {{#each this.sorted as |model|}}
+            <body.row as |row|>
+              <row.headerCell class="nowrap">
+                <Rose::Icon
+                  class={{concat "session-status-" model.status}}
+                  @name="app-icons/action-session"
+                  @size="medium" />
+                <Copyable
+                  @text={{model.id}}
+                  @buttonText={{t "actions.copy-to-clipboard"}}
+                  @acknowledgeText={{t "states.copied"}}
+                >
+                  <code>{{model.id}}</code>
+                </Copyable>
+              </row.headerCell>
+              <row.cell>{{model.target.displayName}}</row.cell>
+              <row.cell>
+                {{!--
+                  Two if's here because:
+                  1) Local proxy info is only relevant if the session is
+                     active or pending (aka isCancelable).  Once the session
+                     is canceled or in the process thereof, the local proxy
+                     may no longer be used.
+                  2) The session actually has proxy information associated
+                     with it.  It's possible for the user to start sessions
+                     from other devices (or even another tab), in which case we
+                     won't have the local proxy info available here.
+                --}}
+                {{#if model.isCancelable}}
+                  {{#if model.proxy}}
+                    <Copyable
+                      @text={{model.proxy}}
+                      @buttonText={{t "actions.copy-to-clipboard"}}
+                      @acknowledgeText={{t "states.copied"}}
+                    >
+                      <code>{{model.proxy}}</code>
+                    </Copyable>
+                  {{/if}}
+                {{/if}}
+              </row.cell>
+              <row.cell>
+                <time datetime={{format-date-iso model.created_time}}>
+                  {{format-date-iso-human model.created_time}}
+                </time>
+              </row.cell>
+              <row.cell>
+                <Rose::Badge>{{model.status}}</Rose::Badge>
+              </row.cell>
+              <row.cell>
+                {{#if model.isCancelable}}
+                  <Rose::Button @style="secondary" {{on "click" (route-action "cancelSession" model)}}>
+                    {{t "actions.cancel"}}
+                  </Rose::Button>
+                {{/if}}
+              </row.cell>
+            </body.row>
+          {{/each}}
+        </table.body>
+      </Rose::Table>
+
+    {{else}}
+
+      <Rose::Layout::Centered>
+        <Rose::Message @title={{t "resources.session.messages.none-friendly.title"}} as |message|>
+          <message.description>
+            {{t "resources.session.messages.none-friendly.description"}}
+          </message.description>
+        </Rose::Message>
+      </Rose::Layout::Centered>
+
+    {{/if}}
+
+  </page.body>
+
+</Rose::Layout::Page>

ui/desktop/app/templates/scopes/scope/projects/targets/index.hbs

@@ -3,48 +3,92 @@
   <page.header>
     <h2>
       {{t "resources.target.title_plural"}}
+      <DocLink @doc="targets" @iconSize="large" />
     </h2>
+    <p>{{t "resources.target.description"}}</p>
   </page.header>
 
   <page.body>
-    <Rose::Table as |table|>
-      <table.header as |header|>
-        <header.row as |row|>
-          <row.headerCell>{{t "form.name.label"}}</row.headerCell>
-          <row.headerCell>{{t "form.id.label"}}</row.headerCell>
-          <row.headerCell>{{t "form.type.label"}}</row.headerCell>
-          <row.headerCell>{{t "resources.project.title"}}</row.headerCell>
-          <row.headerCell />
-        </header.row>
-      </table.header>
-      <table.body as |body|>
-        {{#each @model as |model|}}
-          <body.row as |row|>
-            <row.cell>
-              {{model.target.name}}
-              <p>{{model.target.description}}</p>
-            </row.cell>
-            <row.cell>
-              {{model.target.id}}
-            </row.cell>
-            <row.cell>
-              {{model.target.type}}
-            </row.cell>
-            <row.cell>
-              <Rose::Badge @style='informational'>
-                {{model.project.name}}
-              </Rose::Badge>
-              <p>{{model.project.id}}</p>
-            </row.cell>
-            <row.cell>
-              <Rose::Button @style="secondary" {{on "click" (route-action "connect" model)}}>
-                {{t "resources.session.actions.connect"}}
-              </Rose::Button>
-            </row.cell>
-          </body.row>
-        {{/each}}
-      </table.body>
-    </Rose::Table>
+    {{#if @model}}
+      <Rose::Table as |table|>
+        <table.header as |header|>
+          <header.row as |row|>
+            <row.headerCell>{{t "form.name.label"}}</row.headerCell>
+            <row.headerCell>{{t "form.id.label"}}</row.headerCell>
+            <row.headerCell>{{t "form.type.label"}}</row.headerCell>
+            <row.headerCell>{{t "resources.project.title"}}</row.headerCell>
+            <row.headerCell />
+          </header.row>
+        </table.header>
+        <table.body as |body|>
+          {{#each @model as |model|}}
+            <body.row as |row|>
+              <row.headerCell>
+                <LinkTo
+                  @route="scopes.scope.projects.targets.target"
+                  @model={{model.id}}
+                >
+                  {{model.displayName}}
+                </LinkTo>
+                {{#if model.target.description}}
+                  <p>{{model.target.description}}</p>
+                {{/if}}
+                {{#if model.target.isActive}}
+                  <Rose::Badge @style="success">
+                    {{t "states.active"}}
+                  </Rose::Badge>
+                {{/if}}
+              </row.headerCell>
+              <row.cell>
+                <Copyable
+                  @text={{model.id}}
+                  @buttonText={{t "actions.copy-to-clipboard"}}
+                  @acknowledgeText={{t "states.copied"}}
+                >
+                  <code>{{model.id}}</code>
+                </Copyable>
+              </row.cell>
+              <row.cell>
+                {{#if model.type}}
+                  <Rose::Badge>
+                    {{t (concat "resources.target.types." model.type)}}
+                  </Rose::Badge>
+                {{/if}}
+              </row.cell>
+              <row.cell>
+                <div>
+                  <Copyable
+                    @text={{model.target.id}}
+                    @buttonText={{t "actions.copy-to-clipboard"}}
+                    @acknowledgeText={{t "states.copied"}}
+                  >
+                    <code>{{model.target.id}}</code>
+                  </Copyable>
+                </div>
+                <Rose::Badge @style='informational'>
+                  {{model.project.name}}
+                </Rose::Badge>
+              </row.cell>
+              <row.cell>
+                <Rose::Button @style="secondary" {{on "click" (route-action "connect" model)}}>
+                  {{t "resources.session.actions.connect"}}
+                </Rose::Button>
+              </row.cell>
+            </body.row>
+          {{/each}}
+        </table.body>
+      </Rose::Table>
+    {{else}}
+
+      <Rose::Layout::Centered>
+        <Rose::Message @title={{t "resources.target.messages.none.title"}} as |message|>
+          <message.description>
+            {{t "resources.target.messages.none.description"}}
+          </message.description>
+        </Rose::Message>
+      </Rose::Layout::Centered>
+
+    {{/if}}
   </page.body>
 
 </Rose::Layout::Page>

ui/desktop/app/templates/scopes/scope/projects/targets/target.hbs

@@ -0,0 +1,21 @@
+{{page-title @model.target.displayName}}
+
+<Rose::Layout::Page as |page|>
+
+  <page.header>
+    {{outlet "header"}}
+  </page.header>
+
+  <page.actions>
+    {{outlet "actions"}}
+  </page.actions>
+
+  <page.navigation>
+    {{outlet "navigation"}}
+  </page.navigation>
+
+  <page.body>
+    {{outlet}}
+  </page.body>
+
+</Rose::Layout::Page>

ui/desktop/app/templates/scopes/scope/projects/targets/target/-actions.hbs

@@ -0,0 +1,3 @@
+<Rose::Button @style="primary" {{on "click" (route-action "connect" @model)}}>
+  {{t "resources.session.actions.connect"}}
+</Rose::Button>

ui/desktop/app/templates/scopes/scope/projects/targets/target/-header.hbs

@@ -0,0 +1,19 @@
+<h2>
+  {{@model.displayName}}
+  {{#if @model.isActive}}
+    &nbsp;
+    <Rose::Badge @style="success">
+      {{t "states.active"}}
+    </Rose::Badge>
+  {{/if}}
+</h2>
+<p>{{@model.description}}</p>
+<p>
+  <Copyable
+    @text={{@model.id}}
+    @buttonText={{t "actions.copy-to-clipboard"}}
+    @acknowledgeText={{t "states.copied"}}
+  >
+    <code>{{@model.id}}</code>
+  </Copyable>
+</p>

ui/desktop/app/templates/scopes/scope/projects/targets/target/-navigation.hbs

@@ -0,0 +1,8 @@
+<Rose::Nav::Tabs as |nav|>
+  <nav.link @route='scopes.scope.projects.targets.target.sessions'>
+    {{t 'resources.session.active_plural'}}
+  </nav.link>
+  <nav.link @route='scopes.scope.projects.targets.target.hosts'>
+    {{t 'resources.host.title_plural'}}
+  </nav.link>
+</Rose::Nav::Tabs>

ui/desktop/app/templates/scopes/scope/projects/targets/target/hosts.hbs

@@ -0,0 +1,46 @@
+{{page-title (t "resources.host-set.title_plural")}}
+
+{{#if @model.hosts}}
+
+  <Rose::Table as |table|>
+    <table.body as |body|>
+      {{#each @model.hosts as |host|}}
+        <body.row as |row|>
+          <row.cell>
+            {{host.displayName}}
+            <p>{{host.description}}</p>
+          </row.cell>
+          <row.cell>
+            <Copyable
+              @text={{host.id}}
+              @buttonText={{t "actions.copy-to-clipboard"}}
+              @acknowledgeText={{t "states.copied"}}
+            >
+              <code>{{host.id}}</code>
+            </Copyable>
+          </row.cell>
+          <row.cell>{{host.attributes.address}}</row.cell>
+          <row.cell>
+            <Rose::Badge>{{t (concat 'resources.host.types.' host.type)}}</Rose::Badge>
+          </row.cell>
+          <row.cell>
+            <Rose::Button @style="secondary" {{on "click" (route-action "connect" @model.target host)}}>
+              {{t "resources.session.actions.connect"}}
+            </Rose::Button>
+          </row.cell>
+        </body.row>
+      {{/each}}
+    </table.body>
+  </Rose::Table>
+
+{{else}}
+
+  <Rose::Layout::Centered>
+    <Rose::Message @title={{t "resources.host.messages.none-friendly.title"}} as |message|>
+      <message.description>
+        {{t "resources.host.messages.none-friendly.description"}}
+      </message.description>
+    </Rose::Message>
+  </Rose::Layout::Centered>
+
+{{/if}}

ui/desktop/app/templates/scopes/scope/projects/targets/target/index.hbs

@@ -0,0 +1 @@
+{{outlet}}

ui/desktop/app/templates/scopes/scope/projects/targets/target/sessions.hbs

@@ -0,0 +1,77 @@
+{{#if this.cancelableUserSessions}}
+
+  <Rose::Table as |table|>
+    <table.header as |header|>
+      <header.row as |row|>
+        <row.headerCell>{{t "form.id.label"}}</row.headerCell>
+        <row.headerCell>{{t "form.proxy.label"}}</row.headerCell>
+        <row.headerCell>{{t "form.started.label"}}</row.headerCell>
+        <row.headerCell />
+      </header.row>
+    </table.header>
+    <table.body as |body|>
+
+      {{#each this.cancelableUserSessions as |session|}}
+        <body.row as |row|>
+
+          <row.cell class="nowrap">
+            <Rose::Icon
+              class={{concat "session-status-" session.status}}
+              @name="app-icons/action-session"
+              @size="medium" />
+            <Copyable
+              @text={{session.id}}
+              @buttonText={{t "actions.copy-to-clipboard"}}
+              @acknowledgeText={{t "states.copied"}}
+            >
+              <code>{{session.id}}</code>
+            </Copyable>
+            <Rose::Badge>{{session.status}}</Rose::Badge>
+          </row.cell>
+
+          <row.cell>
+            {{#if session.proxy}}
+              <Copyable
+                @text={{session.proxy}}
+                @buttonText={{t "actions.copy-to-clipboard"}}
+                @acknowledgeText={{t "states.copied"}}
+              >
+                <code>{{session.proxy}}</code>
+              </Copyable>
+            {{/if}}
+          </row.cell>
+
+          <row.cell>
+            <time datetime={{format-date-iso session.created_time}}>
+              {{format-date-iso-human session.created_time}}
+            </time>
+          </row.cell>
+
+          <row.cell>
+            {{#if session.isCancelable}}
+              <Rose::Button
+                @style="secondary"
+                {{on "click" (route-action "cancelSession" session)}}
+              >
+                {{t "actions.cancel"}}
+              </Rose::Button>
+            {{/if}}
+          </row.cell>
+
+        </body.row>
+      {{/each}}
+
+    </table.body>
+  </Rose::Table>
+
+{{else}}
+
+  <Rose::Layout::Centered>
+    <Rose::Message @title={{t "resources.session.messages.none-active-friendly.title"}} as |message|>
+      <message.description>
+        {{t "resources.session.messages.none-active-friendly.description"}}
+      </message.description>
+    </Rose::Message>
+  </Rose::Layout::Centered>
+
+{{/if}}

ui/desktop/config/environment.js

@@ -1,7 +1,6 @@
 'use strict';
 
 const APP_NAME = process.env.APP_NAME || 'Boundary';
-const ENABLE_MIRAGE = process.env.ENABLE_MIRAGE ? false : true;
 
 module.exports = function (environment) {
   let ENV = {
@@ -26,10 +25,12 @@ module.exports = function (environment) {
       // when it is created
     },
 
-    isElectron: Boolean(process.env.EMBER_CLI_ELECTRON),
+    isElectron: process.env.EMBER_CLI_ELECTRON
+      ? JSON.parse(process.env.EMBER_CLI_ELECTRON)
+      : false,
 
     'ember-cli-mirage': {
-      enabled: ENABLE_MIRAGE,
+      //enabled: ENABLE_MIRAGE,
       directory: '../../addons/api/mirage'
     },
 
@@ -42,8 +43,21 @@ module.exports = function (environment) {
     appName: APP_NAME,
 
     notifyTimeout: 4000,
+    sessionPollingTimeoutSeconds: 2.5,
+
+    documentation: {
+      baseURL: 'https://boundaryproject.io/help/desktop',
+      topics: {
+        targets: '/targets',
+        sessions: '/sessions'
+      }
+    }
   };
 
+  if (process.env.ENABLE_MIRAGE) {
+    ENV['ember-cli-mirage'].enabled = JSON.parse(process.env.ENABLE_MIRAGE);
+  }
+
   if (environment === 'development') {
     // ENV.APP.LOG_RESOLVER = true;
     // ENV.APP.LOG_ACTIVE_GENERATION = true;
@@ -70,7 +84,7 @@ module.exports = function (environment) {
 
     // Notification timeout should be 0 for fast tests
     ENV.notifyTimeout = 0;
-    
+
     ENV.enableConfirmService = false;
 
     // Use in-memory storage

ui/desktop/electron-app/.gitignore

@@ -91,3 +91,6 @@ out/
 # Ember build
 ember-dist/
 ember-test/
+
+# CLI
+cli/

ui/desktop/electron-app/config/cli.js

@@ -0,0 +1,40 @@
+const fs = require('fs');
+const path = require('path');
+const https = require('https');
+const decompress = require('decompress');
+const os = require('os');
+
+const artifactVersion = '0.1.6';
+const artifactDestination = path.resolve(__dirname, '..', 'cli');
+
+const downloadArtifact = version => {
+  const url = `https://releases.hashicorp.com/boundary/${version}/boundary_${version}_darwin_amd64.zip`;
+  return new Promise((resolve, reject) => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'boundary-desktop-artifact-'))
+    console.log('Create tmp artifact directory: ', tmpDir);
+
+    const artifactFileName = url.split('/').pop();
+    if(!artifactFileName) reject('Could not find artifact filename in: ', url);
+
+    const artifactPath = path.resolve(tmpDir, artifactFileName);
+    console.log('Download artifact url: ', url);
+    https.get(url, (response) => {
+      const stream = response.pipe(fs.createWriteStream(artifactPath))
+      stream.on('close', () => resolve(artifactPath));
+      stream.on('error', reject);
+    });
+  });
+};
+
+const extract = (artifactPath, destination) => {
+  if (!fs.existsSync(destination)) fs.mkdirSync(destination);
+  console.log('Extract artifact to: ', destination);
+  return decompress(artifactPath, destination);
+};
+
+module.exports = {
+  setup: async () => {
+      const artifactPath = await downloadArtifact(artifactVersion);
+      await extract(artifactPath, artifactDestination);
+  }
+}

ui/desktop/electron-app/config/forge.config.js

@@ -0,0 +1,53 @@
+const process = require('process');
+const { version } = require('../src/boundary-cli.js');
+
+const formattedCLIVersion = version().formatted;
+
+const appVersion = process.env.VERSION
+  ? `Version:  ${process.env.VERSION}\n`
+  : '';
+const appCommit = process.env.COMMIT
+  ? `Commit:  ${process.env.COMMIT}\n`
+  : '';
+
+const formattedAppVersion = `${appVersion}${appCommit}`;
+
+module.exports = {
+  hooks: {
+    prePackage: () => {
+      if (!process.env.BOUNDARY_DESKTOP_SIGNING_IDENTITY) {
+        console.warn('\nWARNING: Could not find signing identity.');
+      }
+    }
+  },
+  packagerConfig: {
+    ignore: [
+      "/ember-test(/|$)",
+      "/tests(/|$)"
+    ],
+    name: "Boundary Desktop",
+    appBundleId: "com.electron.boundary",
+    // TODO: where should the client version number come from?
+    appVersion: `${formattedAppVersion}${formattedCLIVersion}\n`,
+    appCopyright: "Copyright © 2021 HashiCorp, Inc.",
+    icon: "./config/macos/icon.icns",
+    osxSign: {
+      identity: process.env.BOUNDARY_DESKTOP_SIGNING_IDENTITY,
+      "hardened-runtime": true,
+      entitlements: "./config/macos/entitlements.plist",
+      "entitlements-inherit": "./config/macos/entitlements.plist",
+      "signature-flags": "library"
+    }
+  },
+  makers: [
+    {
+      name: "@electron-forge/maker-dmg",
+      config: {
+        title: "Boundary",
+        name: "boundary-desktop",
+        icon: "./config/macos/icon.icns",
+        background: "./config/macos/background.png"
+      }
+    }
+  ]
+}

ui/desktop/electron-app/config/macos/entitlements.plist

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.debugger</key>
+    <true/>
+  </dict>
+</plist>

ui/desktop/electron-app/package.json

@@ -8,52 +8,31 @@
   "author": "HashiCorp",
   "main": "src/index.js",
   "scripts": {
+    "build:cli": "node -e 'require(\"./config/cli.js\").setup()'",
     "start": "electron-forge start",
     "package": "electron-forge package",
+    "premake": "yarn build:cli",
     "make": "electron-forge make",
     "publish": "electron-forge publish",
     "lint": "echo \"No linting configured\""
   },
   "keywords": [],
   "config": {
-    "forge": {
-      "packagerConfig": {
-        "ignore": [
-          "/ember-test(/|$)",
-          "/tests(/|$)"
-        ]
-      },
-      "makers": [
-        {
-          "name": "@electron-forge/maker-zip",
-          "platforms": [
-            "darwin"
-          ]
-        },
-        {
-          "name": "@electron-forge/maker-dmg",
-          "config": {
-            "name": "Boundary"
-          }
-        }
-      ]
-    }
+    "forge": "config/forge.config.js"
   },
   "dependencies": {
     "axios": "^0.21.1",
     "electron-devtools-installer": "^3.1.1",
     "electron-is-dev": "^1.2.0",
     "electron-squirrel-startup": "^1.0.0",
-    "lookpath": "^1.1.0"
+    "lookpath": "^1.1.0",
+    "shell-quote": "^1.7.2"
   },
   "devDependencies": {
     "@electron-forge/cli": "6.0.0-beta.53",
-    "@electron-forge/maker-deb": "6.0.0-beta.53",
     "@electron-forge/maker-dmg": "^6.0.0-beta.54",
-    "@electron-forge/maker-rpm": "6.0.0-beta.53",
-    "@electron-forge/maker-squirrel": "6.0.0-beta.53",
-    "@electron-forge/maker-zip": "6.0.0-beta.53",
+    "decompress": "^4.2.1",
     "devtron": "^1.4.0",
-    "electron": "10.1.5"
+    "electron": "10.2.0"
   }
 }

ui/desktop/electron-app/src/boundary-cli.js

@@ -1,23 +1,57 @@
-const { lookpath } = require('lookpath');
-const spawnPromise = require('./spawn-promise');
+const path = require('path');
+const { spawnAsyncJSONPromise, spawnSync } = require('./spawn-promise');
+const origin = require('./origin.js');
 
-const cliPath = async () => await lookpath('boundary');
+const cliPath = async () => path.resolve(__dirname, '..', 'cli', 'boundary');
+
+/**
+ * Super paranoid shell quote/escape and validation.  Input must be base62.
+ * @param {string} str
+ */
+const escapeAndValidateBase62 = (str) => {
+  const candidate = str.toString();
+  if (candidate.match(/^[A-Za-z0-9_]*$/)) return candidate;
+  throw new Error(`
+    Could not invoke command:
+    input contained unsafe characters.
+  `);
+};
 
 module.exports = {
-  // Find boundary cli path
-  path: () => cliPath(),
   // Check boundary cli existence
   exists: () => Boolean(cliPath()),
   // Initiate connection and return output
-  connect: (target_id, token, addr) => {
+  connect: (target_id, token, host_id) => {
+    const addr = origin.origin;
+    const sanitized = {
+      target_id: escapeAndValidateBase62(target_id),
+      token: escapeAndValidateBase62(token)
+    };
+    if (host_id) sanitized.host_id = escapeAndValidateBase62(host_id);
     const command = [
       'connect',
-      `-target-id=${target_id}`,
-      `-token=${token}`,
+      `-target-id=${sanitized.target_id}`,
+      `-token=${sanitized.token}`,
       `-addr=${addr}`,
       '-format=json',
       '--output-json-errors'
-    ]
-    return spawnPromise(command);
+    ];
+
+    if (host_id) command.push(`-host-id=${sanitized.host_id}`)
+    return spawnAsyncJSONPromise(command);
+  },
+  // Returns JSON-formatted version information from the CLI
+  version: () => {
+    const command = [ '-v' ];
+    const rawOutput = spawnSync(command);
+    let gitRevision = /Git Revision:\s*(?<rev>.*)\n/.exec(rawOutput);
+    let versionNumber = /Version Number:\s*(?<ver>.*)\n/.exec(rawOutput);
+    if (gitRevision) gitRevision = gitRevision.groups.rev;
+    if (versionNumber) versionNumber = versionNumber.groups.ver;
+    const formatted = versionNumber
+      ? `CLI Version:  ${versionNumber}\nCLI Commit:  ${gitRevision}`
+      : `CLI Commit:  ${gitRevision}`;
+    return { gitRevision, versionNumber, formatted };
+    return rawOutput;
   }
 }

ui/desktop/electron-app/src/handlers.js

@@ -1,3 +1,4 @@
+const { shell } = require('electron');
 const handle = require('./ipc-handler');
 const boundaryCli = require('./boundary-cli');
 const origin = require('./origin.js');
@@ -17,17 +18,28 @@ handle('setOrigin', async (requestOrigin) => {
   origin.origin = requestOrigin;
 });
 
+/**
+ * Resets the origin.
+ */
+handle('resetOrigin', async (requestOrigin) => {
+  origin.resetOrigin();
+});
+
+/**
+ * Opens the specified URL in an external browser.
+ */
+handle('openExternal', async (href) => {
+  shell.openExternal(href);
+});
+
 /**
  * Check for boundary cli existence
  */
 handle('cliExists', () => boundaryCli.exists());
 
-/**
- * Detect boundary cli path
- */
-handle('cliPath', () => boundaryCli.path());
-
 /**
  * Establishes a boundary session and returns session details.
  */
-handle('connect', ({ target_id, token, addr }) => boundaryCli.connect(target_id, token, addr));
+handle('connect', ({ target_id, token, host_id }) =>
+  boundaryCli.connect(target_id, token, host_id)
+);

ui/desktop/electron-app/src/index.js

@@ -4,12 +4,14 @@ const {
   default: installExtension,
   EMBER_INSPECTOR,
 } = require('electron-devtools-installer');
-const { session, app, protocol, BrowserWindow, ipcMain } = require('electron');
+const { session, app, protocol, BrowserWindow, ipcMain, Menu } = require('electron');
 require('./handlers.js');
 
 const origin = require('./origin.js');
 const { generateCSPHeader } = require('./content-security-policy.js');
 
+const menu = require('./menu.js');
+
 const isDev = require('electron-is-dev');
 
 // Register the custom file protocol
@@ -38,10 +40,14 @@ app.on('window-all-closed', () => {
 });
 
 app.on('ready', async () => {
-  // Register custom protocol
-  const partition = emberAppName;
+  // Setup a partition
+  // Must be prefixed with persist: in order to save things like localStorage
+  // data.  Without this, the session is in-memory only.
+  // https://www.electronjs.org/docs/api/session#sessionfrompartitionpartition-options
+  const partition = `persist:${emberAppName}`;
   const ses = session.fromPartition(partition);
 
+  // Register custom protocol
   ses.protocol.registerFileProtocol(emberAppProtocol, (request, callback) => {
     const isDir = request.url.endsWith('/');
     const absolutePath = request.url.substr(emberAppURL.length);
@@ -84,9 +90,15 @@ app.on('ready', async () => {
     }
   }
 
+  // Configure menu in prod env
+  if(!isDev) {
+    const menuTemplate = Menu.buildFromTemplate(menu.generateMenuTemplate());
+    Menu.setApplicationMenu(menuTemplate);
+  }
+
   mainWindow = new BrowserWindow({
-    width: 1024,
-    height: 768,
+    width: 1280,
+    height: 760,
     titleBarStyle: 'hiddenInset',
     webPreferences: {
       partition,

ui/desktop/electron-app/src/menu.js

@@ -0,0 +1,89 @@
+const { shell } = require('electron')
+
+const generateMenuTemplate = () => {
+  return [
+    // { role: 'appMenu' }
+    {
+      label: 'Boundary Desktop',
+      submenu: [
+        { role: 'about' },
+        { type: 'separator' },
+        { role: 'services' },
+        { type: 'separator' },
+        { role: 'hide' },
+        { role: 'hideothers' },
+        { role: 'unhide' },
+        { type: 'separator' },
+        { role: 'quit' }
+      ]
+    },
+    // { role: 'fileMenu' }
+    {
+      label: 'File',
+      submenu: [
+        { role: 'close' }
+      ]
+    },
+    // { role: 'editMenu' }
+    {
+      label: 'Edit',
+      submenu: [
+        { role: 'undo' },
+        { role: 'redo' },
+        { type: 'separator' },
+        { role: 'cut' },
+        { role: 'copy' },
+        { role: 'paste' },
+        { role: 'pasteAndMatchStyle' },
+        { role: 'delete' },
+        { role: 'selectAll' },
+        { type: 'separator' },
+        {
+          label: 'Speech',
+          submenu: [
+            { role: 'startSpeaking' },
+            { role: 'stopSpeaking' }
+          ]
+        }
+      ]
+    },
+    // { role: 'viewMenu' }
+    {
+      label: 'View',
+      submenu: [
+        { role: 'reload' },
+        { type: 'separator' },
+        { role: 'resetZoom' },
+        { role: 'zoomIn' },
+        { role: 'zoomOut' },
+        { type: 'separator' },
+        { role: 'togglefullscreen' }
+      ]
+    },
+    // { role: 'windowMenu' }
+    {
+      label: 'Window',
+      submenu: [
+        { role: 'minimize' },
+        { role: 'zoom' },
+        { type: 'separator' },
+        { role: 'front' },
+        { type: 'separator' },
+        { role: 'window' }
+      ]
+    },
+    {
+      role: 'help',
+      submenu: [
+        {
+          label: 'Documentation',
+          click: () => shell.openExternal('https://www.boundaryproject.io')
+        }
+      ]
+    }
+  ]
+}
+
+module.exports = {
+  generateMenuTemplate: generateMenuTemplate
+};

ui/desktop/electron-app/src/origin.js

@@ -17,12 +17,14 @@ class RuntimeSettings {
    */
   get origin() { return this.#origin; }
   set origin(origin) {
-    this.#origin = origin;
-    this.triggerOriginChanged();
+    if (this.#origin !== origin) {
+      this.#origin = origin;
+      this.triggerOriginChanged();
+    }
   }
 
   /**
-   *
+   * Validates the origin is reachable and has a scopes endpoint.
    */
   async validateOrigin(origin) {
     // If the origin is the Electron origin, it is automatically valid.
@@ -38,6 +40,13 @@ class RuntimeSettings {
     }
   }
 
+  /**
+   * Sets the origin to null.
+   */
+  async resetOrigin() {
+    this.origin = null;
+  }
+
   // Quick and dirty event handler pattern to enable the application to respond
   // when the origin is changed.
   #originWatchers = [];

ui/desktop/electron-app/src/spawn-promise.js

@@ -1,4 +1,7 @@
-const { spawn } = require('child_process');
+const path = require('path');
+const { spawn, spawnSync } = require('child_process');
+
+const boundaryPath = path.resolve(__dirname, '..', 'cli', 'boundary');
 
 // Convert to json
 const jsonify = (data) => {
@@ -24,22 +27,44 @@ const jsonify = (data) => {
 // error from the underlying exec implementation.  It's not a very
 // helpful message for users, so it's recommended to craft nice
 // POJO representation and throw it or promise->reject it.
-module.exports = function spawnPromise (command) {
-  return new Promise((resolve, reject) => {
-    const childProcess = spawn('boundary', command);
-    let outputStream = '';
-    let errorStream = '';
+module.exports = {
 
-    childProcess.stdout.on('data', (data) => {
-      outputStream += data.toString();
-      const jsonData = jsonify(outputStream);
-      if(jsonData) resolve(jsonData);
-    });
+  /**
+   * Spawns an asynchronous child process that is expected to output JSON
+   * data on either stdout or stderr.  The process is allowed to continue
+   * running after the promise resolves.  This function is intended to launch
+   * the local proxy.
+   * @param {string} command
+   * @return {Promise}
+   */
+  spawnAsyncJSONPromise(command) {
+    return new Promise((resolve, reject) => {
+      const childProcess = spawn(boundaryPath, command);
+      let outputStream = '';
+      let errorStream = '';
 
-    childProcess.stderr.on('data', (data) => {
-      errorStream += data.toString();
-      const jsonData = jsonify(errorStream);
-      if(jsonData) reject(new Error(jsonData?.error));
+      childProcess.stdout.on('data', (data) => {
+        outputStream += data.toString();
+        const jsonData = jsonify(outputStream);
+        if (jsonData) resolve(jsonData);
+      });
+
+      childProcess.stderr.on('data', (data) => {
+        errorStream += data.toString();
+        const jsonData = jsonify(errorStream);
+        const error = jsonData ? jsonData.error : undefined;
+        if (jsonData) reject(new Error(error));
+      });
     });
-  });
-}
+  },
+
+  /**
+   *
+   */
+  spawnSync(command) {
+    const childProcess = spawnSync(boundaryPath, command);
+    const rawOutput = childProcess.output.toString();
+    return rawOutput;
+  }
+
+};

ui/desktop/electron-app/yarn.lock

@@ -164,16 +164,6 @@
     fs-extra "^9.0.1"
     which "^2.0.2"
 
-"@electron-forge/maker-deb@6.0.0-beta.53":
-  version "6.0.0-beta.53"
-  resolved "https://registry.yarnpkg.com/@electron-forge/maker-deb/-/maker-deb-6.0.0-beta.53.tgz#264b75e4b1467c6aa8aa11ac4d23dbd27a10b017"
-  integrity sha512-bKhfLFY0qfUUPTYuGiU8N4dJKIjWpDeJlE3oP6h49O5GSHwx/eEjQRS2ckT+410HQ3WYXpZFzVc4A8bUz5ej0Q==
-  dependencies:
-    "@electron-forge/maker-base" "6.0.0-beta.53"
-    "@electron-forge/shared-types" "6.0.0-beta.53"
-  optionalDependencies:
-    electron-installer-debian "^3.0.0"
-
 "@electron-forge/maker-dmg@^6.0.0-beta.54":
   version "6.0.0-beta.54"
   resolved "https://registry.yarnpkg.com/@electron-forge/maker-dmg/-/maker-dmg-6.0.0-beta.54.tgz#c3777b28c30c03b3dc18d1ca332d27f8c78c65b1"
@@ -185,37 +175,6 @@
   optionalDependencies:
     electron-installer-dmg "^3.0.0"
 
-"@electron-forge/maker-rpm@6.0.0-beta.53":
-  version "6.0.0-beta.53"
-  resolved "https://registry.yarnpkg.com/@electron-forge/maker-rpm/-/maker-rpm-6.0.0-beta.53.tgz#a7d888c688508b9f7eaac59e693bf291cf5e1d17"
-  integrity sha512-tKL1yYVS6uY7XsuJX8JKQGLtdXDjrr1R8S2JnvvaZ3fT+oDQ0vdptcjQ1QqVTzKNN3VDOI46kLG5gyLVNSl4wQ==
-  dependencies:
-    "@electron-forge/maker-base" "6.0.0-beta.53"
-    "@electron-forge/shared-types" "6.0.0-beta.53"
-  optionalDependencies:
-    electron-installer-redhat "^3.2.0"
-
-"@electron-forge/maker-squirrel@6.0.0-beta.53":
-  version "6.0.0-beta.53"
-  resolved "https://registry.yarnpkg.com/@electron-forge/maker-squirrel/-/maker-squirrel-6.0.0-beta.53.tgz#c34aa0e39a64d25dbd3e31b86f2927cb02fbfe5a"
-  integrity sha512-CoaJPFrxWnOHOgWAmit9OtnBD/JqUPy1hGrMugrjmRvR4xQNQU5mHF2oeY2dQlgYg2Ecdiw1Rf4o8qI/KXu/RQ==
-  dependencies:
-    "@electron-forge/maker-base" "6.0.0-beta.53"
-    "@electron-forge/shared-types" "6.0.0-beta.53"
-    fs-extra "^9.0.1"
-  optionalDependencies:
-    electron-winstaller "^4.0.1"
-
-"@electron-forge/maker-zip@6.0.0-beta.53":
-  version "6.0.0-beta.53"
-  resolved "https://registry.yarnpkg.com/@electron-forge/maker-zip/-/maker-zip-6.0.0-beta.53.tgz#cb12e9abe17c502ce74d9151ea8ee3803d9e8d41"
-  integrity sha512-FwpRSAmYTts0cFVHsWfGG+r3vI8Yyf53cFxAarE7Lll+Efu6I9S43CbusDZR1cB3Ywy2TXs2Kv09rXYJv6OY0A==
-  dependencies:
-    "@electron-forge/maker-base" "6.0.0-beta.53"
-    "@electron-forge/shared-types" "6.0.0-beta.53"
-    cross-zip "^3.0.0"
-    fs-extra "^9.0.1"
-
 "@electron-forge/plugin-base@6.0.0-beta.53":
   version "6.0.0-beta.53"
   resolved "https://registry.yarnpkg.com/@electron-forge/plugin-base/-/plugin-base-6.0.0-beta.53.tgz#d6430ec3cb51f9bfe7386ea6b4a54a582fade8d9"
@@ -307,7 +266,7 @@
     global-agent "^2.0.2"
     global-tunnel-ng "^2.7.1"
 
-"@malept/cross-spawn-promise@^1.0.0", "@malept/cross-spawn-promise@^1.1.0":
+"@malept/cross-spawn-promise@^1.1.0":
   version "1.1.1"
   resolved "https://registry.yarnpkg.com/@malept/cross-spawn-promise/-/cross-spawn-promise-1.1.1.tgz#504af200af6b98e198bce768bc1730c6936ae01d"
   integrity sha512-RTBGWL5FWQcg9orDOCcp4LvItNzUPcyEU9bwaeJX0rJ1IQxzucC48Y0/sQLp/g6t99IQgAlGIaesJS+gTn7tVQ==
@@ -348,13 +307,6 @@
     "@types/node" "*"
     "@types/responselike" "*"
 
-"@types/fs-extra@^9.0.1":
-  version "9.0.6"
-  resolved "https://registry.yarnpkg.com/@types/fs-extra/-/fs-extra-9.0.6.tgz#488e56b77299899a608b8269719c1d133027a6ab"
-  integrity sha512-ecNRHw4clCkowNOBJH1e77nvbPxHYnWIXMv1IAoG/9+MYGkgoyr3Ppxr7XYFNL41V422EDhyV4/4SSK8L2mlig==
-  dependencies:
-    "@types/node" "*"
-
 "@types/glob@^7.1.1":
   version "7.1.3"
   resolved "https://registry.yarnpkg.com/@types/glob/-/glob-7.1.3.tgz#e6ba80f36b7daad2c685acd9266382e68985c183"
@@ -488,21 +440,6 @@ array-find-index@^1.0.1:
   resolved "https://registry.yarnpkg.com/array-find-index/-/array-find-index-1.0.2.tgz#df010aa1287e164bbda6f9723b0a96a1ec4187a1"
   integrity sha1-3wEKoSh+Fku9pvlyOwqWoexBh6E=
 
-asar@^2.0.1:
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/asar/-/asar-2.1.0.tgz#97c6a570408c4e38a18d4a3fb748a621b5a7844e"
-  integrity sha512-d2Ovma+bfqNpvBzY/KU8oPY67ZworixTpkjSx0PCXnQi67c2cXmssaTxpFDUM0ttopXoGx/KRxNg/GDThYbXQA==
-  dependencies:
-    chromium-pickle-js "^0.2.0"
-    commander "^2.20.0"
-    cuint "^0.2.2"
-    glob "^7.1.3"
-    minimatch "^3.0.4"
-    mkdirp "^0.5.1"
-    tmp-promise "^1.0.5"
-  optionalDependencies:
-    "@types/glob" "^7.1.1"
-
 asar@^3.0.0:
   version "3.0.3"
   resolved "https://registry.yarnpkg.com/asar/-/asar-3.0.3.tgz#1fef03c2d6d2de0cbad138788e4f7ae03b129c7b"
@@ -586,6 +523,14 @@ bcrypt-pbkdf@^1.0.0:
   dependencies:
     tweetnacl "^0.14.3"
 
+bl@^1.0.0:
+  version "1.2.3"
+  resolved "https://registry.yarnpkg.com/bl/-/bl-1.2.3.tgz#1e8dd80142eac80d7158c9dccc047fb620e035e7"
+  integrity sha512-pvcNpa0UU69UT341rO6AYy4FVAIkUHuZXRIWbq+zHnsVcRzDDjIAhGuuYoi0d//cwIwtt4pkpKycWEfjdV+vww==
+  dependencies:
+    readable-stream "^2.3.5"
+    safe-buffer "^5.1.1"
+
 bl@^4.0.3:
   version "4.0.3"
   resolved "https://registry.yarnpkg.com/bl/-/bl-4.0.3.tgz#12d6287adc29080e22a705e5764b2a9522cdc489"
@@ -648,7 +593,7 @@ buffer-from@^1.0.0:
   resolved "https://registry.yarnpkg.com/buffer-from/-/buffer-from-1.1.1.tgz#32713bc028f75c02fdb710d7c7bcec1f2c6070ef"
   integrity sha512-MQcXEUbCKtEo7bhqEs6560Hyd4XaovZlO/k9V3hjVUF/zwW7KBVdSK4gIt/bzwS9MbR5qob+F5jusZsb0YQK2A==
 
-buffer@^5.5.0:
+buffer@^5.2.1, buffer@^5.5.0:
   version "5.7.1"
   resolved "https://registry.yarnpkg.com/buffer/-/buffer-5.7.1.tgz#ba62e7c13133053582197160851a8f648e99eed0"
   integrity sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==
@@ -700,11 +645,6 @@ camelcase@^2.0.0:
   resolved "https://registry.yarnpkg.com/camelcase/-/camelcase-2.1.1.tgz#7c1d16d679a1bbe59ca02cacecfb011e201f5a1f"
   integrity sha1-fB0W1nmhu+WcoCys7PsBHiAfWh8=
 
-camelcase@^5.0.0:
-  version "5.3.1"
-  resolved "https://registry.yarnpkg.com/camelcase/-/camelcase-5.3.1.tgz#e3c9b31569e106811df242f715725a1f4c494320"
-  integrity sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==
-
 caseless@~0.12.0:
   version "0.12.0"
   resolved "https://registry.yarnpkg.com/caseless/-/caseless-0.12.0.tgz#1b681c21ff84033c826543090689420d187151dc"
@@ -755,15 +695,6 @@ cli-width@^3.0.0:
   resolved "https://registry.yarnpkg.com/cli-width/-/cli-width-3.0.0.tgz#a2f48437a2caa9a22436e794bf071ec9e61cedf6"
   integrity sha512-FxqpkPPwu1HjuN93Omfm4h8uIanXofW0RxVEW3k5RKx+mJJYSthzNhp32Kzxxy3YAEZ/Dc/EWN1vZRY0+kOhbw==
 
-cliui@^6.0.0:
-  version "6.0.0"
-  resolved "https://registry.yarnpkg.com/cliui/-/cliui-6.0.0.tgz#511d702c0c4e41ca156d7d0e96021f23e13225b1"
-  integrity sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==
-  dependencies:
-    string-width "^4.2.0"
-    strip-ansi "^6.0.0"
-    wrap-ansi "^6.2.0"
-
 cliui@^7.0.2:
   version "7.0.4"
   resolved "https://registry.yarnpkg.com/cliui/-/cliui-7.0.4.tgz#a0265ee655476fc807aea9df3df8df7783808b4f"
@@ -819,7 +750,7 @@ combined-stream@^1.0.6, combined-stream@~1.0.6:
   dependencies:
     delayed-stream "~1.0.0"
 
-commander@^2.20.0:
+commander@^2.8.1:
   version "2.20.3"
   resolved "https://registry.yarnpkg.com/commander/-/commander-2.20.3.tgz#fd485e84c03eb4881c20722ba48035e8531aeb33"
   integrity sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==
@@ -897,18 +828,6 @@ cross-spawn@^7.0.1:
     shebang-command "^2.0.0"
     which "^2.0.1"
 
-cross-zip@^3.0.0:
-  version "3.1.0"
-  resolved "https://registry.yarnpkg.com/cross-zip/-/cross-zip-3.1.0.tgz#2b7d33f2a893bf83e232ccbabf4c6c706f6b313c"
-  integrity sha512-aX02l0SD3KE27pMl69gkxDdDM5D3u9Ic4Je+2b1B2fP0dWnlWWY6ns2Vk5DEgCXJRhL3GasSpicNQRNbDkq0+w==
-  dependencies:
-    rimraf "^3.0.0"
-
-cuint@^0.2.2:
-  version "0.2.2"
-  resolved "https://registry.yarnpkg.com/cuint/-/cuint-0.2.2.tgz#408086d409550c2631155619e9fa7bcadc3b991b"
-  integrity sha1-QICG1AlVDCYxFVYZ6fp7ytw7mRs=
-
 currently-unhandled@^0.4.1:
   version "0.4.1"
   resolved "https://registry.yarnpkg.com/currently-unhandled/-/currently-unhandled-0.4.1.tgz#988df33feab191ef799a61369dd76c17adf957ea"
@@ -944,7 +863,7 @@ debug@^4.0.1, debug@^4.1.0, debug@^4.1.1:
   dependencies:
     ms "2.1.2"
 
-decamelize@^1.1.2, decamelize@^1.2.0:
+decamelize@^1.1.2:
   version "1.2.0"
   resolved "https://registry.yarnpkg.com/decamelize/-/decamelize-1.2.0.tgz#f6534d15148269b20352e7bee26f501f9a191290"
   integrity sha1-9lNNFRSCabIDUue+4m9QH5oZEpA=
@@ -963,6 +882,59 @@ decompress-response@^6.0.0:
   dependencies:
     mimic-response "^3.1.0"
 
+decompress-tar@^4.0.0, decompress-tar@^4.1.0, decompress-tar@^4.1.1:
+  version "4.1.1"
+  resolved "https://registry.yarnpkg.com/decompress-tar/-/decompress-tar-4.1.1.tgz#718cbd3fcb16209716e70a26b84e7ba4592e5af1"
+  integrity sha512-JdJMaCrGpB5fESVyxwpCx4Jdj2AagLmv3y58Qy4GE6HMVjWz1FeVQk1Ct4Kye7PftcdOo/7U7UKzYBJgqnGeUQ==
+  dependencies:
+    file-type "^5.2.0"
+    is-stream "^1.1.0"
+    tar-stream "^1.5.2"
+
+decompress-tarbz2@^4.0.0:
+  version "4.1.1"
+  resolved "https://registry.yarnpkg.com/decompress-tarbz2/-/decompress-tarbz2-4.1.1.tgz#3082a5b880ea4043816349f378b56c516be1a39b"
+  integrity sha512-s88xLzf1r81ICXLAVQVzaN6ZmX4A6U4z2nMbOwobxkLoIIfjVMBg7TeguTUXkKeXni795B6y5rnvDw7rxhAq9A==
+  dependencies:
+    decompress-tar "^4.1.0"
+    file-type "^6.1.0"
+    is-stream "^1.1.0"
+    seek-bzip "^1.0.5"
+    unbzip2-stream "^1.0.9"
+
+decompress-targz@^4.0.0:
+  version "4.1.1"
+  resolved "https://registry.yarnpkg.com/decompress-targz/-/decompress-targz-4.1.1.tgz#c09bc35c4d11f3de09f2d2da53e9de23e7ce1eee"
+  integrity sha512-4z81Znfr6chWnRDNfFNqLwPvm4db3WuZkqV+UgXQzSngG3CEKdBkw5jrv3axjjL96glyiiKjsxJG3X6WBZwX3w==
+  dependencies:
+    decompress-tar "^4.1.1"
+    file-type "^5.2.0"
+    is-stream "^1.1.0"
+
+decompress-unzip@^4.0.1:
+  version "4.0.1"
+  resolved "https://registry.yarnpkg.com/decompress-unzip/-/decompress-unzip-4.0.1.tgz#deaaccdfd14aeaf85578f733ae8210f9b4848f69"
+  integrity sha1-3qrM39FK6vhVePczroIQ+bSEj2k=
+  dependencies:
+    file-type "^3.8.0"
+    get-stream "^2.2.0"
+    pify "^2.3.0"
+    yauzl "^2.4.2"
+
+decompress@^4.2.1:
+  version "4.2.1"
+  resolved "https://registry.yarnpkg.com/decompress/-/decompress-4.2.1.tgz#007f55cc6a62c055afa37c07eb6a4ee1b773f118"
+  integrity sha512-e48kc2IjU+2Zw8cTb6VZcJQ3lgVbS4uuB1TfCHbiZIP/haNXm+SVyhu+87jts5/3ROpd82GSVCoNs/z8l4ZOaQ==
+  dependencies:
+    decompress-tar "^4.0.0"
+    decompress-tarbz2 "^4.0.0"
+    decompress-targz "^4.0.0"
+    decompress-unzip "^4.0.1"
+    graceful-fs "^4.1.10"
+    make-dir "^1.0.0"
+    pify "^2.3.0"
+    strip-dirs "^2.0.0"
+
 deep-extend@^0.6.0:
   version "0.6.0"
   resolved "https://registry.yarnpkg.com/deep-extend/-/deep-extend-0.6.0.tgz#c4fa7c95404a17a9c3e8ca7e1537312b736330ac"
@@ -1052,37 +1024,6 @@ electron-devtools-installer@^3.1.1:
     semver "^7.2.1"
     unzip-crx-3 "^0.2.0"
 
-electron-installer-common@^0.10.2:
-  version "0.10.3"
-  resolved "https://registry.yarnpkg.com/electron-installer-common/-/electron-installer-common-0.10.3.tgz#40f9db644ca60eb28673d545b67ee0113aef4444"
-  integrity sha512-mYbP+6i+nHMIm0WZHXgGdmmXMe+KXncl6jZYQNcCF9C1WsNA9C5SZ2VP4TLQMSIoFO+X4ugkMEA5uld1bmyEvA==
-  dependencies:
-    "@malept/cross-spawn-promise" "^1.0.0"
-    asar "^3.0.0"
-    debug "^4.1.1"
-    fs-extra "^9.0.0"
-    glob "^7.1.4"
-    lodash "^4.17.15"
-    parse-author "^2.0.0"
-    semver "^7.1.1"
-    tmp-promise "^3.0.2"
-  optionalDependencies:
-    "@types/fs-extra" "^9.0.1"
-
-electron-installer-debian@^3.0.0:
-  version "3.1.0"
-  resolved "https://registry.yarnpkg.com/electron-installer-debian/-/electron-installer-debian-3.1.0.tgz#2f6107f559f6564c44e3832fb2942dd8de4d40cc"
-  integrity sha512-k6KChvx0Fw8XTlCqwwbBfh19yGQaKjGdbugokmr1IpzINOm4QFyACKMTHAYFHW5LCBUZQShZD96hwxUZ+8Kx+w==
-  dependencies:
-    "@malept/cross-spawn-promise" "^1.0.0"
-    debug "^4.1.1"
-    electron-installer-common "^0.10.2"
-    fs-extra "^9.0.0"
-    get-folder-size "^2.0.1"
-    lodash "^4.17.4"
-    word-wrap "^1.2.3"
-    yargs "^15.0.1"
-
 electron-installer-dmg@^3.0.0:
   version "3.0.0"
   resolved "https://registry.yarnpkg.com/electron-installer-dmg/-/electron-installer-dmg-3.0.0.tgz#08935b602f3120981c8d5fd24d3f6525f8b0198a"
@@ -1094,19 +1035,6 @@ electron-installer-dmg@^3.0.0:
   optionalDependencies:
     appdmg "^0.6.0"
 
-electron-installer-redhat@^3.2.0:
-  version "3.2.0"
-  resolved "https://registry.yarnpkg.com/electron-installer-redhat/-/electron-installer-redhat-3.2.0.tgz#2c0f5da6f4a244453e4675ab1eca0877a66788c5"
-  integrity sha512-XMA+fQj3ULNVMl4eG+hIvrYITEqP1pfpERvx6kRwuPd06vdtB4KucL9241DAHT0NR5E9gnyJHM9Y6N24kk0mcA==
-  dependencies:
-    "@malept/cross-spawn-promise" "^1.0.0"
-    debug "^4.1.1"
-    electron-installer-common "^0.10.2"
-    fs-extra "^9.0.0"
-    lodash "^4.17.15"
-    word-wrap "^1.2.3"
-    yargs "^15.1.0"
-
 electron-is-dev@^1.2.0:
   version "1.2.0"
   resolved "https://registry.yarnpkg.com/electron-is-dev/-/electron-is-dev-1.2.0.tgz#2e5cea0a1b3ccf1c86f577cee77363ef55deb05e"
@@ -1180,21 +1108,10 @@ electron-squirrel-startup@^1.0.0:
   dependencies:
     debug "^2.2.0"
 
-electron-winstaller@^4.0.1:
-  version "4.0.1"
-  resolved "https://registry.yarnpkg.com/electron-winstaller/-/electron-winstaller-4.0.1.tgz#69da2a439a6986210c3106305f921a522369207d"
-  integrity sha512-wgdABzcMFpREjFCHZKQ5g5JF5jGqa8YCAsVD5Tb3sJhdj63AtuCu/2o++nVESlZZugKDv6Hxo6Wi8c3knEkbgA==
-  dependencies:
-    asar "^2.0.1"
-    debug "^4.1.1"
-    fs-extra "^7.0.1"
-    lodash.template "^4.2.2"
-    temp "^0.9.0"
-
-electron@10.1.5:
-  version "10.1.5"
-  resolved "https://registry.yarnpkg.com/electron/-/electron-10.1.5.tgz#f2b161310f627063e73fbac44efcb35dece83a90"
-  integrity sha512-fys/KnEfJq05TtMij+lFvLuKkuVH030CHYx03iZrW5DNNLwjE6cW3pysJ420lB0FRSfPjTHBMu2eVCf5TG71zQ==
+electron@10.2.0:
+  version "10.2.0"
+  resolved "https://registry.yarnpkg.com/electron/-/electron-10.2.0.tgz#4b00f0907b28aca4b93661bb53ce9a4f8ad32201"
+  integrity sha512-GBUyq8dwUqXPkCTkoID+eZ5Pm9GFlLUd2eSoGe8UOaHeW68SgCf5t75/uGHraQ1OIz/0qniyH5M4ebWEHGppyQ==
   dependencies:
     "@electron/get" "^1.0.1"
     "@types/node" "^12.0.12"
@@ -1215,7 +1132,7 @@ encodeurl@^1.0.2:
   resolved "https://registry.yarnpkg.com/encodeurl/-/encodeurl-1.0.2.tgz#ad3ff4c86ec2d029322f5a02c3a9a606c95b3f59"
   integrity sha1-rT/0yG7C0CkyL1oCw6mmBslbP1k=
 
-end-of-stream@^1.1.0:
+end-of-stream@^1.0.0, end-of-stream@^1.1.0:
   version "1.4.4"
   resolved "https://registry.yarnpkg.com/end-of-stream/-/end-of-stream-1.4.4.tgz#5ae64a5f45057baf3626ec14da0ca5e4b2431eb0"
   integrity sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==
@@ -1343,6 +1260,21 @@ figures@^3.0.0:
   dependencies:
     escape-string-regexp "^1.0.5"
 
+file-type@^3.8.0:
+  version "3.9.0"
+  resolved "https://registry.yarnpkg.com/file-type/-/file-type-3.9.0.tgz#257a078384d1db8087bc449d107d52a52672b9e9"
+  integrity sha1-JXoHg4TR24CHvESdEH1SpSZyuek=
+
+file-type@^5.2.0:
+  version "5.2.0"
+  resolved "https://registry.yarnpkg.com/file-type/-/file-type-5.2.0.tgz#2ddbea7c73ffe36368dfae49dc338c058c2b8ad6"
+  integrity sha1-LdvqfHP/42No365J3DOMBYwritY=
+
+file-type@^6.1.0:
+  version "6.2.0"
+  resolved "https://registry.yarnpkg.com/file-type/-/file-type-6.2.0.tgz#e50cd75d356ffed4e306dc4f5bcf52a79903a919"
+  integrity sha512-YPcTBDV+2Tm0VqjybVd32MHdlEGAtuxS3VAYsumFokDSMG+ROT5wawGlnHDoz7bfMcMDt9hxuXvXwoKUx2fkOg==
+
 filename-reserved-regex@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/filename-reserved-regex/-/filename-reserved-regex-2.0.0.tgz#abf73dfab735d045440abfea2d91f389ebbfa229"
@@ -1372,7 +1304,7 @@ find-up@^2.0.0:
   dependencies:
     locate-path "^2.0.0"
 
-find-up@^4.0.0, find-up@^4.1.0:
+find-up@^4.0.0:
   version "4.1.0"
   resolved "https://registry.yarnpkg.com/find-up/-/find-up-4.1.0.tgz#97afe7d6cdc0bc5928584b7c8d7b16e8a9aa5d19"
   integrity sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==
@@ -1422,6 +1354,11 @@ form-data@~2.3.2:
     combined-stream "^1.0.6"
     mime-types "^2.1.12"
 
+fs-constants@^1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/fs-constants/-/fs-constants-1.0.0.tgz#6be0de9be998ce16af8afc24497b9ee9b7ccd9ad"
+  integrity sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==
+
 fs-extra@^4.0.0:
   version "4.0.3"
   resolved "https://registry.yarnpkg.com/fs-extra/-/fs-extra-4.0.3.tgz#0d852122e5bc5beb453fb028e9c0c9bf36340c94"
@@ -1431,7 +1368,7 @@ fs-extra@^4.0.0:
     jsonfile "^4.0.0"
     universalify "^0.1.0"
 
-fs-extra@^7.0.0, fs-extra@^7.0.1:
+fs-extra@^7.0.0:
   version "7.0.1"
   resolved "https://registry.yarnpkg.com/fs-extra/-/fs-extra-7.0.1.tgz#4f189c44aa123b895f722804f55ea23eadc348e9"
   integrity sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw==
@@ -1504,11 +1441,6 @@ galactus@^0.2.1:
     flora-colossus "^1.0.0"
     fs-extra "^4.0.0"
 
-gar@^1.0.4:
-  version "1.0.4"
-  resolved "https://registry.yarnpkg.com/gar/-/gar-1.0.4.tgz#f777bc7db425c0572fdeb52676172ca1ae9888b8"
-  integrity sha512-w4n9cPWyP7aHxKxYHFQMegj7WIAsL/YX/C4Bs5Rr8s1H9M1rNtRWRsw+ovYMkXDQ5S4ZbYHsHAPmevPjPgw44w==
-
 gauge@~2.7.3:
   version "2.7.4"
   resolved "https://registry.yarnpkg.com/gauge/-/gauge-2.7.4.tgz#2c03405c7538c39d7eb37b317022e325fb018bf7"
@@ -1537,19 +1469,11 @@ generate-object-property@^1.1.0:
   dependencies:
     is-property "^1.0.0"
 
-get-caller-file@^2.0.1, get-caller-file@^2.0.5:
+get-caller-file@^2.0.5:
   version "2.0.5"
   resolved "https://registry.yarnpkg.com/get-caller-file/-/get-caller-file-2.0.5.tgz#4f94412a82db32f36e3b0b9741f8a97feb031f7e"
   integrity sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==
 
-get-folder-size@^2.0.1:
-  version "2.0.1"
-  resolved "https://registry.yarnpkg.com/get-folder-size/-/get-folder-size-2.0.1.tgz#3fe0524dd3bad05257ef1311331417bcd020a497"
-  integrity sha512-+CEb+GDCM7tkOS2wdMKTn9vU7DgnKUTuDlehkNJKNSovdCOVxs14OfKCk4cvSaR3za4gj+OBdl9opPN9xrJ0zA==
-  dependencies:
-    gar "^1.0.4"
-    tiny-each-async "2.0.3"
-
 get-installed-path@^2.0.3:
   version "2.1.1"
   resolved "https://registry.yarnpkg.com/get-installed-path/-/get-installed-path-2.1.1.tgz#a1f33dc6b8af542c9331084e8edbe37fe2634152"
@@ -1572,6 +1496,14 @@ get-stdin@^4.0.1:
   resolved "https://registry.yarnpkg.com/get-stdin/-/get-stdin-4.0.1.tgz#b968c6b0a04384324902e8bf1a5df32579a450fe"
   integrity sha1-uWjGsKBDhDJJAui/Gl3zJXmkUP4=
 
+get-stream@^2.2.0:
+  version "2.3.1"
+  resolved "https://registry.yarnpkg.com/get-stream/-/get-stream-2.3.1.tgz#5f38f93f346009666ee0150a054167f91bdd95de"
+  integrity sha1-Xzj5PzRgCWZu4BUKBUFn+Rvdld4=
+  dependencies:
+    object-assign "^4.0.1"
+    pinkie-promise "^2.0.0"
+
 get-stream@^4.0.0, get-stream@^4.1.0:
   version "4.1.0"
   resolved "https://registry.yarnpkg.com/get-stream/-/get-stream-4.1.0.tgz#c1b255575f3dc21d59bfc79cd3d2b46b1c3a54b5"
@@ -1689,7 +1621,7 @@ got@^9.6.0:
     to-readable-stream "^1.0.0"
     url-parse-lax "^3.0.0"
 
-graceful-fs@^4.1.2, graceful-fs@^4.1.6, graceful-fs@^4.2.0, graceful-fs@^4.2.3:
+graceful-fs@^4.1.10, graceful-fs@^4.1.2, graceful-fs@^4.1.6, graceful-fs@^4.2.0, graceful-fs@^4.2.3:
   version "4.2.4"
   resolved "https://registry.yarnpkg.com/graceful-fs/-/graceful-fs-4.2.4.tgz#2256bde14d3632958c465ebc96dc467ca07a29fb"
   integrity sha512-WjKPNJF79dtJAVniUlGGWHYGz2jWxT6VhN/4m1NdkbZ2nOsEF+cI1Edgql5zCRhs/VsQYRvrXctxktVXZUkixw==
@@ -1906,6 +1838,11 @@ is-my-json-valid@^2.20.0:
     jsonpointer "^4.0.0"
     xtend "^4.0.0"
 
+is-natural-number@^4.0.1:
+  version "4.0.1"
+  resolved "https://registry.yarnpkg.com/is-natural-number/-/is-natural-number-4.0.1.tgz#ab9d76e1db4ced51e35de0c72ebecf09f734cde8"
+  integrity sha1-q5124dtM7VHjXeDHLr7PCfc0zeg=
+
 is-property@^1.0.0, is-property@^1.0.2:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/is-property/-/is-property-1.0.2.tgz#57fe1c4e48474edd65b09911f26b1cd4095dda84"
@@ -2105,32 +2042,12 @@ locate-path@^6.0.0:
   dependencies:
     p-locate "^5.0.0"
 
-lodash._reinterpolate@^3.0.0:
-  version "3.0.0"
-  resolved "https://registry.yarnpkg.com/lodash._reinterpolate/-/lodash._reinterpolate-3.0.0.tgz#0ccf2d89166af03b3663c796538b75ac6e114d9d"
-  integrity sha1-DM8tiRZq8Ds2Y8eWU4t1rG4RTZ0=
-
 lodash.get@^4.0.0:
   version "4.4.2"
   resolved "https://registry.yarnpkg.com/lodash.get/-/lodash.get-4.4.2.tgz#2d177f652fa31e939b4438d5341499dfa3825e99"
   integrity sha1-LRd/ZS+jHpObRDjVNBSZ36OCXpk=
 
-lodash.template@^4.2.2:
-  version "4.5.0"
-  resolved "https://registry.yarnpkg.com/lodash.template/-/lodash.template-4.5.0.tgz#f976195cf3f347d0d5f52483569fe8031ccce8ab"
-  integrity sha512-84vYFxIkmidUiFxidA/KjjH9pAycqW+h980j7Fuz5qxRtO9pgB7MDFTdys1N7A5mcucRiDyEq4fusljItR1T/A==
-  dependencies:
-    lodash._reinterpolate "^3.0.0"
-    lodash.templatesettings "^4.0.0"
-
-lodash.templatesettings@^4.0.0:
-  version "4.2.0"
-  resolved "https://registry.yarnpkg.com/lodash.templatesettings/-/lodash.templatesettings-4.2.0.tgz#e481310f049d3cf6d47e912ad09313b154f0fb33"
-  integrity sha512-stgLz+i3Aa9mZgnjr/O+v9ruKZsPsndy7qPZOchbqk2cnTU1ZaldKK+v7m54WoKIyxiuMZTKT2H81F8BeAc3ZQ==
-  dependencies:
-    lodash._reinterpolate "^3.0.0"
-
-lodash@^4.17.10, lodash@^4.17.15, lodash@^4.17.19, lodash@^4.17.20, lodash@^4.17.4:
+lodash@^4.17.10, lodash@^4.17.19, lodash@^4.17.20:
   version "4.17.20"
   resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.20.tgz#b44a9b6297bcb698f1c51a3545a2b3b368d59c52"
   integrity sha512-PlhdFcillOINfeV7Ni6oF1TAEayyZBoZ8bcshTHqOYJYlrqzRK5hagpagky5o4HfCzzd1TRkXPMFq6cKk9rGmA==
@@ -2189,6 +2106,13 @@ macos-alias@~0.2.5:
   dependencies:
     nan "^2.4.0"
 
+make-dir@^1.0.0:
+  version "1.3.0"
+  resolved "https://registry.yarnpkg.com/make-dir/-/make-dir-1.3.0.tgz#79c1033b80515bd6d24ec9933e860ca75ee27f0c"
+  integrity sha512-2w31R7SJtieJJnQtGc7RVL2StM2vGYVfqUOvUDxH6bC6aJTxPxTF0GnIgCyu7tjockiUWAYQRbxa7vKn34s5sQ==
+  dependencies:
+    pify "^3.0.0"
+
 map-age-cleaner@^0.1.1:
   version "0.1.3"
   resolved "https://registry.yarnpkg.com/map-age-cleaner/-/map-age-cleaner-0.1.3.tgz#7d583a7306434c055fe474b0f45078e6e1b4b92a"
@@ -2755,7 +2679,7 @@ performance-now@^2.1.0:
   resolved "https://registry.yarnpkg.com/performance-now/-/performance-now-2.1.0.tgz#6309f4e0e5fa913ec1c69307ae364b4b377c9e7b"
   integrity sha1-Ywn04OX6kT7BxpMHrjZLSzd8nns=
 
-pify@^2.0.0:
+pify@^2.0.0, pify@^2.3.0:
   version "2.3.0"
   resolved "https://registry.yarnpkg.com/pify/-/pify-2.3.0.tgz#ed141a6ac043a849ea588498e7dca8b15330e90c"
   integrity sha1-7RQaasBDqEnqWISY59yosVMw6Qw=
@@ -2921,7 +2845,7 @@ read-pkg@^2.0.0:
     normalize-package-data "^2.3.2"
     path-type "^2.0.0"
 
-readable-stream@^2.0.6, readable-stream@^2.2.2, readable-stream@^2.3.5, readable-stream@~2.3.6:
+readable-stream@^2.0.6, readable-stream@^2.2.2, readable-stream@^2.3.0, readable-stream@^2.3.5, readable-stream@~2.3.6:
   version "2.3.7"
   resolved "https://registry.yarnpkg.com/readable-stream/-/readable-stream-2.3.7.tgz#1eca1cf711aef814c04f62252a36a62f6cb23b57"
   integrity sha512-Ebho8K4jIbHAxnuxi7o42OrZgF/ZTNcsZj6nRKyUmkhLFq8CHItp/fy6hQZuZmP/n3yZ9VBUbp4zz/mX8hmYPw==
@@ -3004,11 +2928,6 @@ require-directory@^2.1.1:
   resolved "https://registry.yarnpkg.com/require-directory/-/require-directory-2.1.1.tgz#8c64ad5fd30dab1c976e2344ffe7f792a6a6df42"
   integrity sha1-jGStX9MNqxyXbiNE/+f3kqam30I=
 
-require-main-filename@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/require-main-filename/-/require-main-filename-2.0.0.tgz#d0b329ecc7cc0f61649f62215be69af54aa8989b"
-  integrity sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==
-
 resolve-alpn@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/resolve-alpn/-/resolve-alpn-1.0.0.tgz#745ad60b3d6aff4b4a48e01b8c0bdc70959e0e8c"
@@ -3059,27 +2978,20 @@ restore-cursor@^3.1.0:
     onetime "^5.1.0"
     signal-exit "^3.0.2"
 
-rimraf@^2.6.1, rimraf@^2.6.3, rimraf@^2.7.1:
+rimraf@^2.6.1, rimraf@^2.7.1:
   version "2.7.1"
   resolved "https://registry.yarnpkg.com/rimraf/-/rimraf-2.7.1.tgz#35797f13a7fdadc566142c29d4f07ccad483e3ec"
   integrity sha512-uWjbaKIK3T1OSVptzX7Nl6PvQ3qAGtKEtVRjRuazjfL3Bx5eI409VZSqgND+4UNnmzLVdPj9FqFJNPqBZFve4w==
   dependencies:
     glob "^7.1.3"
 
-rimraf@^3.0.0, rimraf@^3.0.2:
+rimraf@^3.0.2:
   version "3.0.2"
   resolved "https://registry.yarnpkg.com/rimraf/-/rimraf-3.0.2.tgz#f1a5402ba6220ad52cc1282bac1ae3aa49fd061a"
   integrity sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==
   dependencies:
     glob "^7.1.3"
 
-rimraf@~2.6.2:
-  version "2.6.3"
-  resolved "https://registry.yarnpkg.com/rimraf/-/rimraf-2.6.3.tgz#b2d104fe0d8fb27cf9e0a1cda8262dd3833c6cab"
-  integrity sha512-mwqeW5XsA2qAejG46gYdENaxXjx9onRNCfn7L0duuP4hCuTIi/QO7PDK07KJfp1d+izWPrzEJDcSqBa0OZQriA==
-  dependencies:
-    glob "^7.1.3"
-
 roarr@^2.15.3:
   version "2.15.4"
   resolved "https://registry.yarnpkg.com/roarr/-/roarr-2.15.4.tgz#f5fe795b7b838ccfe35dc608e0282b9eba2e7afd"
@@ -3104,7 +3016,7 @@ rxjs@^6.6.0:
   dependencies:
     tslib "^1.9.0"
 
-safe-buffer@^5.0.1, safe-buffer@^5.1.2, safe-buffer@~5.2.0:
+safe-buffer@^5.0.1, safe-buffer@^5.1.1, safe-buffer@^5.1.2, safe-buffer@~5.2.0:
   version "5.2.1"
   resolved "https://registry.yarnpkg.com/safe-buffer/-/safe-buffer-5.2.1.tgz#1eaf9fa9bdb1fdd4ec75f58f9cdb4e6b7827eec6"
   integrity sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==
@@ -3131,6 +3043,13 @@ sax@^1.2.4:
   resolved "https://registry.yarnpkg.com/sax/-/sax-1.2.4.tgz#2816234e2378bddc4e5354fab5caa895df7100d9"
   integrity sha512-NqVDv9TpANUjFm0N8uM5GxL36UgKi9/atZw+x7YFnQ8ckwFGKrl4xX4yWtrey3UJm5nP1kUbnYgLopqWNSRhWw==
 
+seek-bzip@^1.0.5:
+  version "1.0.6"
+  resolved "https://registry.yarnpkg.com/seek-bzip/-/seek-bzip-1.0.6.tgz#35c4171f55a680916b52a07859ecf3b5857f21c4"
+  integrity sha512-e1QtP3YL5tWww8uKaOCQ18UxIT2laNBXHjV/S2WYCiK4udiv8lkG89KRIoCjUagnAmCBurjF4zEVX2ByBbnCjQ==
+  dependencies:
+    commander "^2.8.1"
+
 semver-compare@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/semver-compare/-/semver-compare-1.0.0.tgz#0dee216a1c941ab37e9efb1788f6afc5ff5537fc"
@@ -3141,7 +3060,7 @@ semver-compare@^1.0.0:
   resolved "https://registry.yarnpkg.com/semver/-/semver-5.7.1.tgz#a954f931aeba508d307bbf069eff0c01c96116f7"
   integrity sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==
 
-semver@^7.1.1, semver@^7.1.3, semver@^7.2.1, semver@^7.3.2:
+semver@^7.1.3, semver@^7.2.1, semver@^7.3.2:
   version "7.3.4"
   resolved "https://registry.yarnpkg.com/semver/-/semver-7.3.4.tgz#27aaa7d2e4ca76452f98d3add093a72c943edc97"
   integrity sha512-tCfb2WLjqFAtXn4KEdxIhalnRtoKFN7nAwj0B3ZXCbQloV2tq5eDbcTmT68JJD3nRJq24/XgxtQKFIpQdtvmVw==
@@ -3155,7 +3074,7 @@ serialize-error@^7.0.1:
   dependencies:
     type-fest "^0.13.1"
 
-set-blocking@^2.0.0, set-blocking@~2.0.0:
+set-blocking@~2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/set-blocking/-/set-blocking-2.0.0.tgz#045f9782d011ae9a6803ddd382b24392b3d890f7"
   integrity sha1-BF+XgtARrppoA93TgrJDkrPYkPc=
@@ -3189,6 +3108,11 @@ shebang-regex@^3.0.0:
   resolved "https://registry.yarnpkg.com/shebang-regex/-/shebang-regex-3.0.0.tgz#ae16f1644d873ecad843b0307b143362d4c42172"
   integrity sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==
 
+shell-quote@^1.7.2:
+  version "1.7.2"
+  resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.7.2.tgz#67a7d02c76c9da24f99d20808fcaded0e0e04be2"
+  integrity sha512-mRz/m/JVscCrkMyPqHc/bczi3OQHkLTqXHEFu0zDhK/qfv3UcOA4SVmRCLmos4bhjr9ekVQubj/R7waKapmiQg==
+
 signal-exit@^3.0.0, signal-exit@^3.0.2:
   version "3.0.3"
   resolved "https://registry.yarnpkg.com/signal-exit/-/signal-exit-3.0.3.tgz#a1410c2edd8f077b08b4e253c8eacfcaf057461c"
@@ -3348,6 +3272,13 @@ strip-bom@^3.0.0:
   resolved "https://registry.yarnpkg.com/strip-bom/-/strip-bom-3.0.0.tgz#2334c18e9c759f7bdd56fdef7e9ae3d588e68ed3"
   integrity sha1-IzTBjpx1n3vdVv3vfprj1YjmjtM=
 
+strip-dirs@^2.0.0:
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/strip-dirs/-/strip-dirs-2.1.0.tgz#4987736264fc344cf20f6c34aca9d13d1d4ed6c5"
+  integrity sha512-JOCxOeKLm2CAS73y/U4ZeZPTkE+gNVCzKt7Eox84Iej1LT/2pTWYpZKJuxwQpvX1LiZb1xokNR7RLfuBAa7T3g==
+  dependencies:
+    is-natural-number "^4.0.1"
+
 strip-eof@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/strip-eof/-/strip-eof-1.0.0.tgz#bb43ff5598a6eb05d89b59fcd129c983313606bf"
@@ -3391,6 +3322,19 @@ supports-color@^7.1.0:
   dependencies:
     has-flag "^4.0.0"
 
+tar-stream@^1.5.2:
+  version "1.6.2"
+  resolved "https://registry.yarnpkg.com/tar-stream/-/tar-stream-1.6.2.tgz#8ea55dab37972253d9a9af90fdcd559ae435c555"
+  integrity sha512-rzS0heiNf8Xn7/mpdSVVSMAWAoy9bfb1WOTYC78Z0UQKeKa/CWS8FOq0lKGNa8DWKAn9gxjCvMLYc5PGXYlK2A==
+  dependencies:
+    bl "^1.0.0"
+    buffer-alloc "^1.2.0"
+    end-of-stream "^1.0.0"
+    fs-constants "^1.0.0"
+    readable-stream "^2.3.0"
+    to-buffer "^1.1.1"
+    xtend "^4.0.0"
+
 tar@^4:
   version "4.4.13"
   resolved "https://registry.yarnpkg.com/tar/-/tar-4.4.13.tgz#43b364bc52888d555298637b10d60790254ab525"
@@ -3416,14 +3360,6 @@ tar@^6.0.2, tar@^6.0.5:
     mkdirp "^1.0.3"
     yallist "^4.0.0"
 
-temp@^0.9.0:
-  version "0.9.4"
-  resolved "https://registry.yarnpkg.com/temp/-/temp-0.9.4.tgz#cd20a8580cb63635d0e4e9d4bd989d44286e7620"
-  integrity sha512-yYrrsWnrXMcdsnu/7YMYAofM1ktpL5By7vZhf15CrXijWWrEYZks5AXBudalfSWJLlnen/QUJUB5aoB0kqZUGA==
-  dependencies:
-    mkdirp "^0.5.1"
-    rimraf "~2.6.2"
-
 throttleit@0.0.2:
   version "0.0.2"
   resolved "https://registry.yarnpkg.com/throttleit/-/throttleit-0.0.2.tgz#cfedf88e60c00dd9697b61fdd2a8343a9b680eaf"
@@ -3437,38 +3373,11 @@ through2@~0.2.3:
     readable-stream "~1.1.9"
     xtend "~2.1.1"
 
-through@^2.3.6:
+through@^2.3.6, through@^2.3.8:
   version "2.3.8"
   resolved "https://registry.yarnpkg.com/through/-/through-2.3.8.tgz#0dd4c9ffaabc357960b1b724115d7e0e86a2e1f5"
   integrity sha1-DdTJ/6q8NXlgsbckEV1+Doai4fU=
 
-tiny-each-async@2.0.3:
-  version "2.0.3"
-  resolved "https://registry.yarnpkg.com/tiny-each-async/-/tiny-each-async-2.0.3.tgz#8ebbbfd6d6295f1370003fbb37162afe5a0a51d1"
-  integrity sha1-jru/1tYpXxNwAD+7NxYq/loKUdE=
-
-tmp-promise@^1.0.5:
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/tmp-promise/-/tmp-promise-1.1.0.tgz#bb924d239029157b9bc1d506a6aa341f8b13e64c"
-  integrity sha512-8+Ah9aB1IRXCnIOxXZ0uFozV1nMU5xiu7hhFVUSxZ3bYu+psD4TzagCzVbexUCgNNGJnsmNDQlS4nG3mTyoNkw==
-  dependencies:
-    bluebird "^3.5.0"
-    tmp "0.1.0"
-
-tmp-promise@^3.0.2:
-  version "3.0.2"
-  resolved "https://registry.yarnpkg.com/tmp-promise/-/tmp-promise-3.0.2.tgz#6e933782abff8b00c3119d63589ca1fb9caaa62a"
-  integrity sha512-OyCLAKU1HzBjL6Ev3gxUeraJNlbNingmi8IrHHEsYH8LTmEuhvYfqvhn2F/je+mjf4N58UmZ96OMEy1JanSCpA==
-  dependencies:
-    tmp "^0.2.0"
-
-tmp@0.1.0:
-  version "0.1.0"
-  resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.1.0.tgz#ee434a4e22543082e294ba6201dcc6eafefa2877"
-  integrity sha512-J7Z2K08jbGcdA1kkQpJSqLF6T0tdQqpR2pnSUXsIchbPdTI9v3e85cLW0d6WDhwuAleOV71j2xWs8qMPfK7nKw==
-  dependencies:
-    rimraf "^2.6.3"
-
 tmp@^0.0.33:
   version "0.0.33"
   resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.0.33.tgz#6d34335889768d21b2bcda0aa277ced3b1bfadf9"
@@ -3476,13 +3385,6 @@ tmp@^0.0.33:
   dependencies:
     os-tmpdir "~1.0.2"
 
-tmp@^0.2.0:
-  version "0.2.1"
-  resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.1.tgz#8457fc3037dcf4719c251367a1af6500ee1ccf14"
-  integrity sha512-76SUhtfqR2Ijn+xllcI5P1oyannHNHByD80W1q447gU3mp9G9PSpGdWmjUOHRDPiHYacIk66W7ubDTuPF3BEtQ==
-  dependencies:
-    rimraf "^3.0.0"
-
 tn1150@^0.1.0:
   version "0.1.0"
   resolved "https://registry.yarnpkg.com/tn1150/-/tn1150-0.1.0.tgz#673503d24d56b87de8b8c77fee3fc0853d59a18d"
@@ -3490,6 +3392,11 @@ tn1150@^0.1.0:
   dependencies:
     unorm "^1.4.1"
 
+to-buffer@^1.1.1:
+  version "1.1.1"
+  resolved "https://registry.yarnpkg.com/to-buffer/-/to-buffer-1.1.1.tgz#493bd48f62d7c43fcded313a03dcadb2e1213a80"
+  integrity sha512-lx9B5iv7msuFYE3dytT+KE5tap+rNYw+K4jVkb9R/asAb+pbBSM17jtunHplhBe6RRJdZx3Pn2Jph24O32mOVg==
+
 to-readable-stream@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/to-readable-stream/-/to-readable-stream-1.0.0.tgz#ce0aa0c2f3df6adf852efb404a783e77c0475771"
@@ -3559,6 +3466,14 @@ typedarray@^0.0.6:
   resolved "https://registry.yarnpkg.com/typedarray/-/typedarray-0.0.6.tgz#867ac74e3864187b1d3d47d996a78ec5c8830777"
   integrity sha1-hnrHTjhkGHsdPUfZlqeOxciDB3c=
 
+unbzip2-stream@^1.0.9:
+  version "1.4.3"
+  resolved "https://registry.yarnpkg.com/unbzip2-stream/-/unbzip2-stream-1.4.3.tgz#b0da04c4371311df771cdc215e87f2130991ace7"
+  integrity sha512-mlExGW4w71ebDJviH16lQLtZS32VKqsSfk80GCfUlwT/4/hNRFsoscrF/c++9xinkMzECL1uL9DDwXqFWkruPg==
+  dependencies:
+    buffer "^5.2.1"
+    through "^2.3.8"
+
 universalify@^0.1.0:
   version "0.1.2"
   resolved "https://registry.yarnpkg.com/universalify/-/universalify-0.1.2.tgz#b646f69be3942dabcecc9d6639c80dc105efaa66"
@@ -3649,11 +3564,6 @@ wcwidth@^1.0.1:
   dependencies:
     defaults "^1.0.3"
 
-which-module@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/which-module/-/which-module-2.0.0.tgz#d9ef07dce77b9902b8a3a8fa4b31c3e3f7e6e87a"
-  integrity sha1-2e8H3Od7mQK4o6j6SzHD4/fm6Ho=
-
 which@^1.2.14, which@^1.2.9:
   version "1.3.1"
   resolved "https://registry.yarnpkg.com/which/-/which-1.3.1.tgz#a45043d54f5805316da8d62f9f50918d3da70b0a"
@@ -3675,20 +3585,6 @@ wide-align@^1.1.0:
   dependencies:
     string-width "^1.0.2 || 2"
 
-word-wrap@^1.2.3:
-  version "1.2.3"
-  resolved "https://registry.yarnpkg.com/word-wrap/-/word-wrap-1.2.3.tgz#610636f6b1f703891bd34771ccb17fb93b47079c"
-  integrity sha512-Hz/mrNwitNRh/HUAtM/VT/5VH+ygD6DV7mYKZAtHOrbs8U7lvPS6xf7EJKMF0uW1KJCl0H701g3ZGus+muE5vQ==
-
-wrap-ansi@^6.2.0:
-  version "6.2.0"
-  resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-6.2.0.tgz#e9393ba07102e6c91a3b221478f0257cd2856e53"
-  integrity sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==
-  dependencies:
-    ansi-styles "^4.0.0"
-    string-width "^4.1.0"
-    strip-ansi "^6.0.0"
-
 wrap-ansi@^7.0.0:
   version "7.0.0"
   resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-7.0.0.tgz#67e145cff510a6a6984bdf1152911d69d2eb9e43"
@@ -3725,11 +3621,6 @@ xtend@~2.1.1:
   dependencies:
     object-keys "~0.4.0"
 
-y18n@^4.0.0:
-  version "4.0.1"
-  resolved "https://registry.yarnpkg.com/y18n/-/y18n-4.0.1.tgz#8db2b83c31c5d75099bb890b23f3094891e247d4"
-  integrity sha512-wNcy4NvjMYL8gogWWYAO7ZFWFfHcbdbE57tZO8e4cbpj8tfUcwrwqSl3ad8HxpYWCdXcJUCeKKZS62Av1affwQ==
-
 y18n@^5.0.5:
   version "5.0.5"
   resolved "https://registry.yarnpkg.com/y18n/-/y18n-5.0.5.tgz#8769ec08d03b1ea2df2500acef561743bbb9ab18"
@@ -3750,36 +3641,11 @@ yallist@^4.0.0:
   resolved "https://registry.yarnpkg.com/yallist/-/yallist-4.0.0.tgz#9bb92790d9c0effec63be73519e11a35019a3a72"
   integrity sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==
 
-yargs-parser@^18.1.2:
-  version "18.1.3"
-  resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-18.1.3.tgz#be68c4975c6b2abf469236b0c870362fab09a7b0"
-  integrity sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==
-  dependencies:
-    camelcase "^5.0.0"
-    decamelize "^1.2.0"
-
 yargs-parser@^20.0.0, yargs-parser@^20.2.2:
   version "20.2.4"
   resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-20.2.4.tgz#b42890f14566796f85ae8e3a25290d205f154a54"
   integrity sha512-WOkpgNhPTlE73h4VFAFsOnomJVaovO8VqLDzy5saChRBFQFBoMYirowyW+Q9HB4HFF4Z7VZTiG3iSzJJA29yRA==
 
-yargs@^15.0.1, yargs@^15.1.0:
-  version "15.4.1"
-  resolved "https://registry.yarnpkg.com/yargs/-/yargs-15.4.1.tgz#0d87a16de01aee9d8bec2bfbf74f67851730f4f8"
-  integrity sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A==
-  dependencies:
-    cliui "^6.0.0"
-    decamelize "^1.2.0"
-    find-up "^4.1.0"
-    get-caller-file "^2.0.1"
-    require-directory "^2.1.1"
-    require-main-filename "^2.0.0"
-    set-blocking "^2.0.0"
-    string-width "^4.2.0"
-    which-module "^2.0.0"
-    y18n "^4.0.0"
-    yargs-parser "^18.1.2"
-
 yargs@^16.0.0:
   version "16.2.0"
   resolved "https://registry.yarnpkg.com/yargs/-/yargs-16.2.0.tgz#1c82bf0f6b6a66eafce7ef30e376f49a12477f66"
@@ -3801,7 +3667,7 @@ yarn-or-npm@^3.0.1:
     cross-spawn "^6.0.5"
     pkg-dir "^4.2.0"
 
-yauzl@^2.10.0:
+yauzl@^2.10.0, yauzl@^2.4.2:
   version "2.10.0"
   resolved "https://registry.yarnpkg.com/yauzl/-/yauzl-2.10.0.tgz#c7eb17c93e112cb1086fa6d8e51fb0667b79a5f9"
   integrity sha1-x+sXyT4RLLEIb6bY5R+wZnt5pfk=

ui/desktop/package.json

@@ -11,8 +11,9 @@
   },
   "scripts": {
     "doc:toc": "doctoc README.md",
-    "build": "ember build --environment=production && yarn build:desktop",
+    "build": "EMBER_CLI_ELECTRON=true ember build --environment=production && yarn build:desktop",
     "build:development": "ember build",
+    "prebuild:desktop": "cp -r dist/ electron-app/ember-dist/",
     "build:desktop": "cd electron-app && yarn make",
     "lint": "npm-run-all --aggregate-output --continue-on-error --parallel lint:*",
     "lint:hbs": "ember-template-lint .",
@@ -23,6 +24,7 @@
     "format:js": "prettier --write '{app,config,stories,tests,electron-app/src}/**/*.js' *.js",
     "format:sass": "prettier --write app/**/*.scss",
     "start": "ember serve",
+    "prestart:desktop": "cd electron-app && yarn build:cli",
     "start:desktop": "ember electron",
     "clean:coverage": "rm -rf coverage_*",
     "pretest": "yarn clean:coverage",
@@ -33,12 +35,15 @@
   },
   "devDependencies": {
     "@doyensec/electronegativity": "^1.7.0",
+    "@ember/jquery": "^1.1.0",
     "@ember/optional-features": "^1.3.0",
+    "@ember/render-modifiers": "^1.0.2",
     "@glimmer/component": "^1.0.1",
     "@glimmer/tracking": "^1.0.0",
     "babel-eslint": "^10.1.0",
     "babel-loader": "^8.1.0",
     "broccoli-asset-rev": "^3.0.0",
+    "clipboard": "^2.0.6",
     "core": "*",
     "doctoc": "^1.4.0",
     "ember-auto-import": "^1.6.0",
@@ -54,6 +59,7 @@
     "ember-cli-sri": "^2.1.1",
     "ember-cli-template-lint": "^2.0.2",
     "ember-cli-uglify": "^3.0.0",
+    "ember-concurrency": "^1.3.0",
     "ember-electron": "https://github.com/adopted-ember-addons/ember-electron#v3.0.0-beta.4",
     "ember-exam": "^6.0.1",
     "ember-export-application-global": "^2.0.1",

ui/desktop/public/app-icons/global.svg

@@ -1,3 +0,0 @@
-<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M5.97503 7.25H10.0232C9.83952 5.33678 9.13836 3.52559 7.99998 2.00183C6.85742 3.53084 6.15589 5.3466 5.97503 7.25ZM10.025 8.75C9.84413 10.6534 9.14259 12.4692 8.00003 13.9982C6.86166 12.4744 6.16049 10.6632 5.97679 8.75H10.025ZM11.5309 8.75H14.4572C14.1478 11.4433 12.1921 13.6359 9.62187 14.296C10.707 12.6405 11.3662 10.7347 11.5309 8.75ZM14.4572 7.25H11.5293C11.3619 5.25743 10.7034 3.35494 9.62165 1.70392C12.192 2.36401 14.1478 4.55661 14.4572 7.25ZM4.46913 7.25H1.5428C1.85224 4.55668 3.80789 2.36413 6.37814 1.70397C5.29298 3.35946 4.63378 5.2653 4.46913 7.25ZM4.47076 8.75H1.5428C1.85224 11.4434 3.808 13.636 6.37836 14.2961C5.29662 12.6451 4.63811 10.7426 4.47076 8.75ZM0 8C0 3.58172 3.58172 0 8 0L8.00195 3.05531e-06C12.4193 0.00105872 16 3.58237 16 8C16 12.4183 12.4183 16 8 16C3.58172 16 0 12.4183 0 8Z" fill="currentColor"/>
-</svg>

ui/desktop/public/app-icons/org.svg

@@ -1,3 +0,0 @@
-<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M7.15625 12.1875H5V16H0V0H12V5.125H15.5V16H12H10.5H7.15625V12.1875ZM10.5 14.5H8.65625V10.6875H3.5V14.5H1.5V1.5H10.5V5.125V14.5ZM12 14.5H14V6.625H12V14.5ZM3 3H4.88235V5H3V3ZM4.88235 7H3V9H4.88235V7ZM7 3H8.88235V5H7V3ZM8.88235 7H7V9H8.88235V7Z" fill="currentColor"/>
-</svg>

ui/desktop/public/logo-app.svg

@@ -1,71 +0,0 @@
-<svg
-  width="30"
-  height="30"
-  xmlns="http://www.w3.org/2000/svg"
-  viewBox="0 0 67 67">
-
-  <g class="logomark">
-    <polygon
-      fill="#f04e54"
-      points="9.89 64.1 9.89 59.28 19.9 59.28 19.9 56.3 15.05 56.3 15.05 51.45 37.97 51.45 27.32 33.01 37.97 14.57 14.47 14.57 14.47 40.15 1.82 40.15 1.82 1.92 45.34 1.92 52.61 14.5 41.92 33.01 52.83 51.9 45.78 64.1 9.89 64.1">
-    </polygon>
-
-    <rect
-      fill="#f04e54"
-      x="6.98"
-      y="51.45"
-      width="4.85"
-      height="4.85">
-    </rect>
-
-    <rect
-      fill="#f04e54"
-      x="1.82"
-      y="59.25"
-      width="4.85"
-      height="4.85">
-    </rect>
-  </g>
-
-  <g class="logotype">
-    <path
-      fill="#ffffff"
-      d="M104.58,32.17c3.08-1.33,4.48-3.21,4.48-6.54V21.45c0-5.44-3.09-8.59-10.72-8.59H82.5v40.3H99.44c7.32,0,11-3.57,11-9.26V39.61C110.45,35.67,108.27,33,104.58,32.17Zm-14.46-13h7.32c2.78,0,4,1,4,3.27V26c0,2.36-1.08,3.76-4.05,3.76H90.12Zm12.71,23.78c0,3-1.46,3.94-4.91,3.94h-7.8v-11h8.47c3,0,4.24,1.33,4.24,4Z">
-    </path>
-
-    <path
-      fill="#ffffff"
-      d="M126.48,23.09c-10.1,0-12.82,5.56-12.82,11.62v7.44c0,6.05,2.72,11.61,12.82,11.61s12.83-5.56,12.83-11.61V34.71C139.31,28.65,136.58,23.09,126.48,23.09Zm5.45,19.3c0,3.33-1.51,5.08-5.45,5.08S121,45.72,121,42.39V34.47c0-3.34,1.51-5.09,5.44-5.09s5.45,1.75,5.45,5.09Z">
-    </path>
-
-    <path
-      fill="#ffffff"
-      d="M161.46,23.69V44.15c-2.67,1.39-5.88,2.48-7.69,2.48s-2.36-.79-2.36-2.37V23.69H144V45.05c0,5.27,1.75,8.71,6.65,8.71a29.59,29.59,0,0,0,11.8-3.08l.73,2.48h5.63V23.69Z">
-    </path>
-
-    <path
-      fill="#ffffff"
-      d="M193.34,23.09a29.59,29.59,0,0,0-11.8,3.08l-.72-2.48h-5.63V53.16h7.38V32.71c2.66-1.39,5.87-2.48,7.68-2.48s2.36.79,2.36,2.36V53.16H200V31.8C200,26.54,198.24,23.09,193.34,23.09Z">
-    </path>
-
-    <path
-      fill="#ffffff"
-      d="M222.44,11.66V23.94a41,41,0,0,0-7.87-.85c-6.83,0-9.73,3.87-9.73,10.41v10c0,6.72,3.14,10.22,9.07,10.22a15.48,15.48,0,0,0,9.32-3.08l.72,2.48h5.87V10.63Zm0,33.15a10.43,10.43,0,0,1-6.59,2.66c-2.73,0-3.63-1.33-3.63-3.75V33.32c0-2.67,1-3.94,3.69-3.94a33,33,0,0,1,6.53.79Z">
-    </path>
-
-    <path
-      fill="#ffffff"
-      d="M245.74,23.09a38.76,38.76,0,0,0-10.11,1.39l.91,5.63a40.74,40.74,0,0,1,8.17-.91c4.71,0,5.62,1.15,5.62,4.42V36.7h-7.07c-6,0-8.6,2.3-8.6,8.29,0,5.09,2.3,8.77,7.69,8.77a16.06,16.06,0,0,0,8.77-2.6l.54,2h6.06V33.74C257.72,26.35,255,23.09,245.74,23.09Zm4.59,23.29a11.57,11.57,0,0,1-5.56,1.51c-2.3,0-3-.9-3-3,0-2.24.67-2.9,3.09-2.9h5.44Z">
-    </path>
-
-    <path
-      fill="#ffffff"
-      d="M277.92,23.09A33,33,0,0,0,270.18,27l-.48-3.27h-6.24V53.16h7.39v-19a56,56,0,0,1,7.8-4.29Z">
-    </path>
-
-    <path
-      fill="#ffffff"
-      d="M300.61,23.69l-6.77,22.39-6.72-22.39h-7.56l9.32,29.47h2.59l-3.68,11.92h7l3.93-11.92,9.44-29.47Z">
-    </path>
-  </g>
-</svg>

ui/desktop/tests/acceptance/authentication-test.js

@@ -3,19 +3,20 @@ import {
   visit,
   currentURL,
   //fillIn,
-  //click,
+  click,
   find,
   //findAll,
-  //getRootElement
+  getRootElement,
   //setupOnerror,
 } from '@ember/test-helpers';
+import { run, later } from '@ember/runloop';
 import { setupApplicationTest } from 'ember-qunit';
 import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
 //import { Response } from 'miragejs';
 //import a11yAudit from 'ember-a11y-testing/test-support/audit';
 import {
   currentSession,
-  //authenticateSession,
+  authenticateSession,
   invalidateSession,
 } from 'ember-simple-auth/test-support';
 
@@ -159,4 +160,38 @@ module('Acceptance | authentication', function (hooks) {
     assert.equal(currentURL(), urls.authenticate.global);
     assert.ok(find('.rose-message'));
   });
+
+  test('color theme is applied from session data', async function (assert) {
+    assert.expect(12);
+    authenticateSession({
+      scope: {
+        id: instances.scopes.global.id,
+        type: instances.scopes.global.type
+      },
+    });
+    later(async () => {
+      run.cancelTimers();
+      // system default
+      assert.notOk(currentSession().get('data.theme'));
+      assert.notOk(getRootElement().classList.contains('rose-theme-light'));
+      assert.notOk(getRootElement().classList.contains('rose-theme-dark'));
+      // toggle light mode
+      await click('[name="theme"][value="light"]');
+      assert.equal(currentSession().get('data.theme'), 'light');
+      assert.ok(getRootElement().classList.contains('rose-theme-light'));
+      assert.notOk(getRootElement().classList.contains('rose-theme-dark'));
+      // toggle dark mode
+      await click('[name="theme"][value="dark"]');
+      assert.equal(currentSession().get('data.theme'), 'dark');
+      assert.notOk(getRootElement().classList.contains('rose-theme-light'));
+      assert.ok(getRootElement().classList.contains('rose-theme-dark'));
+      // toggle system default
+      await click('[name="theme"][value=""]');
+      assert.notOk(currentSession().get('data.theme'));
+      assert.notOk(getRootElement().classList.contains('rose-theme-light'));
+      assert.notOk(getRootElement().classList.contains('rose-theme-dark'));
+    }, 750);
+
+    await visit(urls.scopes.org);
+  });
 });

ui/desktop/tests/acceptance/targets-test.js

@@ -9,6 +9,7 @@ import {
   //getRootElement
   //setupOnerror,
 } from '@ember/test-helpers';
+import { run, later } from '@ember/runloop';
 import { setupApplicationTest } from 'ember-qunit';
 import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
 //import { Response } from 'miragejs';
@@ -151,8 +152,16 @@ module('Acceptance | targets', function (hooks) {
 
   test('visiting index', async function (assert) {
     assert.expect(1);
+    // This later/cancelTimers technique allows us to test a page with
+    // active polling.  Normally an acceptance test waits for all runloop timers
+    // to stop before returning from an awaited test, but polling means that
+    // runloop timers exist indefinitely.  We thus schedule a cancelation before
+    // proceeding with our tests.
+    later(async () => {
+      run.cancelTimers();
+      //await a11yAudit();
+      assert.equal(currentURL(), urls.targets);
+    }, 750);
     await visit(urls.targets);
-    //await a11yAudit();
-    assert.equal(currentURL(), urls.targets);
   });
 });

ui/desktop/tests/integration/components/copyable-test.js

@@ -0,0 +1,17 @@
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { render, find } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+
+module('Integration | Component | copyable', function (hooks) {
+  setupRenderingTest(hooks);
+
+  test('it renders', async function (assert) {
+    await render(
+      hbs`<Copyable @buttonText="Copy me" @text="foo">text</Copyable>`
+    );
+    assert.ok(find('.copyable'));
+    assert.equal(find('.copyable-content').textContent.trim(), 'text');
+    assert.equal(find('.copyable-button').textContent.trim(), 'Copy me');
+  });
+});

ui/desktop/tests/unit/controllers/scopes/scope/projects/sessions/index-test.js

@@ -0,0 +1,12 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module('Unit | Controller | scopes/scope/projects/sessions/index', function(hooks) {
+  setupTest(hooks);
+
+  // TODO: Replace this with your real tests.
+  test('it exists', function(assert) {
+    let controller = this.owner.lookup('controller:scopes/scope/projects/sessions/index');
+    assert.ok(controller);
+  });
+});

ui/desktop/tests/unit/controllers/scopes/scope/projects/targets/target/sessions-test.js

@@ -0,0 +1,12 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module('Unit | Controller | scopes/scope/projects/targets/target/sessions', function(hooks) {
+  setupTest(hooks);
+
+  // TODO: Replace this with your real tests.
+  test('it exists', function(assert) {
+    let controller = this.owner.lookup('controller:scopes/scope/projects/targets/target/sessions');
+    assert.ok(controller);
+  });
+});

ui/desktop/tests/unit/initializers/ipc-test.js

@@ -1,28 +0,0 @@
-import Application from '@ember/application';
-
-import { initialize } from 'desktop/initializers/ipc';
-import { module, test } from 'qunit';
-import { run } from '@ember/runloop';
-
-module('Unit | Initializer | ipc', function(hooks) {
-  hooks.beforeEach(function() {
-    this.TestApplication = Application.extend();
-    this.TestApplication.initializer({
-      name: 'initializer under test',
-      initialize
-    });
-
-    this.application = this.TestApplication.create({ autoboot: false });
-  });
-
-  hooks.afterEach(function() {
-    run(this.application, 'destroy');
-  });
-
-  // TODO: Replace this with your real tests.
-  test('it works', async function(assert) {
-    await this.application.boot();
-
-    assert.ok(true);
-  });
-});

ui/desktop/tests/unit/routes/scopes/scope/projects/sessions-test.js

@@ -0,0 +1,11 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module('Unit | Route | scopes/scope/projects/sessions', function(hooks) {
+  setupTest(hooks);
+
+  test('it exists', function(assert) {
+    let route = this.owner.lookup('route:scopes/scope/projects/sessions');
+    assert.ok(route);
+  });
+});

ui/desktop/tests/unit/routes/scopes/scope/projects/sessions/index-test.js

@@ -0,0 +1,11 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module('Unit | Route | scopes/scope/projects/sessions/index', function(hooks) {
+  setupTest(hooks);
+
+  test('it exists', function(assert) {
+    let route = this.owner.lookup('route:scopes/scope/projects/sessions/index');
+    assert.ok(route);
+  });
+});

ui/desktop/tests/unit/routes/scopes/scope/projects/targets/target-test.js

@@ -0,0 +1,11 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module('Unit | Route | scopes/scope/projects/targets/target', function(hooks) {
+  setupTest(hooks);
+
+  test('it exists', function(assert) {
+    let route = this.owner.lookup('route:scopes/scope/projects/targets/target');
+    assert.ok(route);
+  });
+});

ui/desktop/tests/unit/routes/scopes/scope/projects/targets/target/hosts-test.js

@@ -0,0 +1,11 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module('Unit | Route | scopes/scope/projects/targets/target/hosts', function(hooks) {
+  setupTest(hooks);
+
+  test('it exists', function(assert) {
+    let route = this.owner.lookup('route:scopes/scope/projects/targets/target/hosts');
+    assert.ok(route);
+  });
+});

ui/desktop/tests/unit/routes/scopes/scope/projects/targets/target/index-test.js

@@ -0,0 +1,11 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module('Unit | Route | scopes/scope/projects/targets/target/index', function(hooks) {
+  setupTest(hooks);
+
+  test('it exists', function(assert) {
+    let route = this.owner.lookup('route:scopes/scope/projects/targets/target/index');
+    assert.ok(route);
+  });
+});

ui/desktop/tests/unit/routes/scopes/scope/projects/targets/target/sessions-test.js

@@ -0,0 +1,11 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module('Unit | Route | scopes/scope/projects/targets/target/sessions', function(hooks) {
+  setupTest(hooks);
+
+  test('it exists', function(assert) {
+    let route = this.owner.lookup('route:scopes/scope/projects/targets/target/sessions');
+    assert.ok(route);
+  });
+});

yarn-audit-known-issues

@@ -1,21 +1,21 @@
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}