CVE-2022-2027: Improper Neutralization of Formula Elements in a CSV File (CWE-1236)
value: Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0.
CWE description: The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
CVSS v3 base score: 8
Published: 2022-06-09T17:15Z
Repository: https://github.com/kromitgmbh/titra
Language: JavaScript
Files changed: .meteor/release, .meteor/versions, imports/ui/components/allprojectschart.js, imports/ui/components/dailytimetable.js, imports/ui/components/detailtimetable.js, imports/ui/components/periodtimetable.js, imports/ui/components/projectAccessRights.js, imports/ui/components/projectchart.js, imports/ui/pages/dashboard.js, imports/utils/frontend_helpers.js, imports/utils/server_method_helpers.js, package-lock.json, package.json
Commit date: 2022-06-07 15:13:20 +0200
Commit message: 🔒 fixes three critical stored XSS vulnerabilities thanks @saharshtapi for reporting this
🔒 fixes a formula injection vulnerability in the Excel export functionality thanks @saharshtapi for reprorting this
❗️this is an important security release, we recommend to migrate asap, all titra versions below version 0.77.0 are considered insecure for production use

Diff: diff --git a/.meteor/release b/.meteor/release
index 2246232..66dd7b6 100644
--- a/.meteor/release
+++ b/.meteor/release
@@ -1 +1 @@
-METEOR@2.7.2
+METEOR@2.7.3
diff --git a/.meteor/versions b/.meteor/versions
index 1b15d07..0b91b81 100644
--- a/.meteor/versions
+++ b/.meteor/versions
@@ -87,11 +87,11 @@ standard-minifier-js@2.8.0
 templating@1.4.1
 templating-compiler@1.4.1
 templating-runtime@1.5.0
 templating-tools@1.2.2
 tracker@1.2.0
-tunguska:reactive-aggregate@1.3.7
+tunguska:reactive-aggregate@1.3.8
 ui@1.0.13
 underscore@1.0.10
 url@1.3.2
 webapp@1.13.1
 webapp-hashing@1.1.0
diff --git a/imports/ui/components/allprojectschart.js b/imports/ui/components/allprojectschart.js
index ed12899..7b18474 100644
--- a/imports/ui/components/allprojectschart.js
+++ b/imports/ui/components/allprojectschart.js
@@ -126,11 +126,11 @@ Template.allprojectschart.onRendered(() => {
             templateInstance.piechart = new Chart(templateInstance.$('.js-pie-chart-container')[0], {
               type: 'pie',
               colors: ['#009688', '#455A64', '#e4e4e4'],
               height: 230,
               data: {
-                labels: templateInstance.topTasks.get().map((task) => task._id),
+                labels: templateInstance.topTasks.get().map((task) => $('<span>').text(task._id).html()),
                 datasets: [{
                   values: templateInstance.topTasks.get().map((task) => task.count),
                 }],
               },
               tooltipOptions: {
diff --git a/imports/ui/components/dailytimetable.js b/imports/ui/components/dailytimetable.js
index ebcfc8f..fa53db8 100644
--- a/imports/ui/components/dailytimetable.js
+++ b/imports/ui/components/dailytimetable.js
@@ -9,10 +9,11 @@ import './limitpicker.js'
 import {
   getGlobalSetting,
   numberWithUserPrecision,
   getUserSetting,
   getUserTimeUnitVerbose,
+  addToolTipToTableCell,
 } from '../../utils/frontend_helpers'
 import { i18nReady, t } from '../../utils/i18n.js'
 import { dailyTimecardMapper } from '../../utils/server_method_helpers'
 
 Template.dailytimetable.onCreated(function dailytimetablecreated() {
@@ -66,12 +67,22 @@ Template.dailytimetable.onRendered(() => {
           name: t('globals.date'),
           editable: false,
           width: 1,
           compareValue: (cell, keyword) => [dayjs(cell, getGlobalSetting('dateformat')).toDate(), dayjs(keyword, getGlobalSetting('dateformat')).toDate()],
         },
-        { name: t('globals.project'), editable: false, width: 2 },
-        { name: t('globals.resource'), editable: false, width: 2 },
+        {
+          name: t('globals.project'),
+          editable: false,
+          width: 2,
+          format: addToolTipToTableCell,
+        },
+        {
+          name: t('globals.resource'),
+          editable: false,
+          width: 2,
+          format: addToolTipToTableCell,
+        },
         {
           name: getUserTimeUnitVerbose(),
           editable: false,
           width: 1,
           format: numberWithUserPrecision,
diff --git a/imports/ui/components/detailtimetable.js b/imports/ui/components/detailtimetable.js
index e4d46c0..2996eeb 100644
--- a/imports/ui/components/detailtimetable.js
+++ b/imports/ui/components/detailtimetable.js
@@ -34,11 +34,11 @@ if (getGlobalSetting('showNameOfCustomFieldInDetails')) {
 
 function detailedDataTableMapper(entry) {
   const project = Projects.findOne({ _id: entry.projectId })
   const mapping = [project ? project.name : '',
     dayjs.utc(entry.date).format(getGlobalSetting('dateformat')),
-    entry.task,
+    entry.task.replace(/^=/, '='),
     projectUsers.findOne() ? projectUsers.findOne().users.find((elem) => elem._id === entry.userId)?.profile?.name : '']
   if (getGlobalSetting('showCustomFieldsInDetails')) {
     if (CustomFields.find({ classname: 'time_entry' }).count() > 0) {
       for (const customfield of CustomFields.find({ classname: 'time_entry' }).fetch()) {
         mapping.push(entry[customfield[customFieldType]])
diff --git a/imports/ui/components/periodtimetable.js b/imports/ui/components/periodtimetable.js
index 9989a45..aaa0512 100644
--- a/imports/ui/components/periodtimetable.js
+++ b/imports/ui/components/periodtimetable.js
@@ -9,10 +9,11 @@ import './limitpicker.js'
 import { i18nReady, t } from '../../utils/i18n.js'
 import {
   numberWithUserPrecision,
   getUserSetting,
   getUserTimeUnitVerbose,
+  addToolTipToTableCell,
 } from '../../utils/frontend_helpers.js'
 import { totalHoursForPeriodMapper } from '../../utils/server_method_helpers.js'
 
 Template.periodtimetable.onCreated(function periodtimetableCreated() {
   dayjs.extend(utc)
@@ -59,12 +60,12 @@ Template.periodtimetable.onRendered(() => {
         data = templateInstance.periodTimecards.get().map(totalHoursForPeriodMapper)
           .map((entry) => Object.entries(entry)
             .map((key) => key[1]))
       }
       const columns = [
-        { name: t('globals.project'), editable: false },
-        { name: t('globals.resource'), editable: false },
+        { name: t('globals.project'), editable: false, format: addToolTipToTableCell },
+        { name: t('globals.resource'), editable: false, format: addToolTipToTableCell },
         {
           name: getUserTimeUnitVerbose(),
           editable: false,
           format: numberWithUserPrecision,
         },
diff --git a/imports/ui/components/projectAccessRights.js b/imports/ui/components/projectAccessRights.js
index ff26678..86b0b4d 100644
--- a/imports/ui/components/projectAccessRights.js
+++ b/imports/ui/components/projectAccessRights.js
@@ -1,10 +1,10 @@
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra'
 import './projectAccessRights.html'
 import { t, i18nReady } from '../../utils/i18n.js'
 import {
-  validateEmail, getGlobalSetting, showToast,
+  validateEmail, getGlobalSetting, showToast, addToolTipToTableCell,
 } from '../../utils/frontend_helpers'
 import Projects from '../../api/projects/projects.js'
 
 Template.projectAccessRights.onCreated(function projectAccessRightsCreated() {
   this.project = new ReactiveVar()
@@ -26,10 +26,11 @@ Template.projectAccessRights.onRendered(() => {
       const columns = [
         {
           name: t('globals.name'),
           editable: false,
           focusable: false,
+          format: addToolTipToTableCell,
         }, {
           name: t('project.access_rights'),
           editable: false,
           focusable: false,
           format: (value) => {
diff --git a/imports/ui/components/projectchart.js b/imports/ui/components/projectchart.js
index d714f56..d43d43b 100644
--- a/imports/ui/components/projectchart.js
+++ b/imports/ui/components/projectchart.js
@@ -198,11 +198,11 @@ Template.projectchart.onRendered(() => {
               templateInstance.piechart = new Chart(templateInstance.$('.js-pie-chart-container')[0], {
                 type: 'pie',
                 colors: [Projects.findOne({ _id: templateInstance.data.projectId }).color || '#009688', '#66c0b8', '#e4e4e4'],
                 height: 230,
                 data: {
-                  labels: templateInstance.topTasks.get().map((task) => task._id),
+                  labels: templateInstance.topTasks.get().map((task) => $('<span>').text(task._id).html()),
                   datasets: [{
                     values: templateInstance.topTasks.get().map((task) => task.count),
                   }],
                 },
                 tooltipOptions: {
diff --git a/imports/ui/pages/dashboard.js b/imports/ui/pages/dashboard.js
index 71b7c12..e296485 100644
--- a/imports/ui/pages/dashboard.js
+++ b/imports/ui/pages/dashboard.js
@@ -8,10 +8,11 @@ import {
   emojify,
   getUserSetting,
   getGlobalSetting,
   timeInUserUnit,
   getUserTimeUnitVerbose,
+  addToolTipToTableCell,
 } from '../../utils/frontend_helpers'
 import './dashboard.html'
 import Timecards from '../../api/timecards/timecards'
 import Projects from '../../api/projects/projects'
 import { Dashboards } from '../../api/dashboards/dashboards'
@@ -124,11 +125,11 @@ Template.dashboard.onRendered(() => {
           const taskmap = new Map()
           const datemap = new Map()
           const precision = getUserSetting('precision')
           for (const timecard of Timecards.find({}, { sort: { date: 1 } }).fetch()) {
             taskmap.set(
-              timecard.task.replace(/(:\S*:)/g, emojify),
+              $('<span>').text(timecard.task.replace(/(:\S*:)/g, emojify)).html(),
               taskmap.get(timecard.task.replace(/(:\S*:)/g, emojify))
                 ? Number(Number(taskmap.get(timecard.task.replace(/(:\S*:)/g, emojify))) + Number(timeInUnitHelper(timecard.hours)))
                 : Number(timeInUnitHelper(timecard.hours)),
             )
             datemap.set(
diff --git a/imports/utils/frontend_helpers.js b/imports/utils/frontend_helpers.js
index 3179a27..9960474 100644
--- a/imports/utils/frontend_helpers.js
+++ b/imports/utils/frontend_helpers.js
@@ -16,11 +16,12 @@ function getUserSetting(field) {
   return false
 }
 
 function addToolTipToTableCell(value) {
   if (value) {
-    return `<span class="js-tooltip" data-bs-toggle="tooltip" data-bs-placement="left" title="${value}">${value}</span>`
+    const sanitizedValue = $('<div/>').text(value).html()
+    return `<span class="js-tooltip" data-bs-toggle="tooltip" data-bs-placement="left" title='${sanitizedValue}'>${sanitizedValue}</span>`
   }
   return ''
 }
 
 function getWeekDays(date) {
diff --git a/imports/utils/server_method_helpers.js b/imports/utils/server_method_helpers.js
index 6283c9d..06e8b37 100644
--- a/imports/utils/server_method_helpers.js
+++ b/imports/utils/server_method_helpers.js
@@ -65,11 +65,12 @@ function totalHoursForPeriodMapper(entry) {
       totalHours = Number(entry.totalHours * 60)
     }
   }
   return {
     projectId: Projects.findOne({ _id: entry._id.projectId }).name,
-    userId: projectUsers.findOne().users.find((elem) => elem._id === entry._id.userId)?.profile?.name,
+    userId: projectUsers
+      .findOne().users.find((elem) => elem._id === entry._id.userId)?.profile?.name,
     totalHours,
   }
 }
 
 function dailyTimecardMapper(entry) {
diff --git a/package-lock.json b/package-lock.json
index baa85d6..b43d76c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -791,13 +791,13 @@
         "jalaali-js": "^1.2.6",
         "moment-timezone": "^0.5.34"
       }
     },
     "dayjs": {
-      "version": "1.11.2",
-      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.2.tgz",
-      "integrity": "sha512-F4LXf1OeU9hrSYRPTTj/6FbO4HTjPKXvEIC1P2kcnFurViINCVk3ZV0xAS3XVx9MkMsXbbqlK6hjseaYbgKEHw=="
+      "version": "1.11.3",
+      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.3.tgz",
+      "integrity": "sha512-xxwlswWOlGhzgQ4TKzASQkUhqERI3egRNqgV4ScR8wlANA/A9tZ7miXa44vTTKEq5l7vWoL5G57bG3zA+Kow0A=="
     },
     "dayjs-precise-range": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/dayjs-precise-range/-/dayjs-precise-range-1.0.1.tgz",
       "integrity": "sha512-d2Af99ennTt+DykEDt4aZHk6roMJA2Zb6KmI5pQnvei/4quCJwFqVsYKOKE3c5ZjjJasAUVm2xLoCewKJ/4Vgg=="
@@ -960,13 +960,13 @@
       "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
       "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
       "dev": true
     },
     "eslint": {
-      "version": "8.16.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.16.0.tgz",
-      "integrity": "sha512-MBndsoXY/PeVTDJeWsYj7kLZ5hQpJOfMYLsF6LicLHQWbRDG19lK5jOix4DPl8yY4SUFcE3txy86OzFLWT+yoA==",
+      "version": "8.17.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.17.0.tgz",
+      "integrity": "sha512-gq0m0BTJfci60Fz4nczYxNAlED+sMcihltndR8t9t1evnU/azx53x3t2UHXC/uRjcbvRw/XctpaNygSTcQD+Iw==",
       "dev": true,
       "requires": {
         "@eslint/eslintrc": "^1.3.0",
         "@humanwhocodes/config-array": "^0.9.2",
         "ajv": "^6.10.0",
@@ -1395,11 +1395,11 @@
       "dev": true
     },
     "fast-levenshtein": {
       "version": "2.0.6",
       "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
-      "integrity": "sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc=",
+      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
       "dev": true
     },
     "file-entry-cache": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-6.0.1.tgz",
@@ -1483,11 +1483,11 @@
       "integrity": "sha512-yIovAzMX49sF8Yl58fSCWJ5svSLuaibPxXQJFLmBObTuCr0Mf1KiPopGM9NiFjiYBCbfaa2Fh6breQ6ANVTI0A=="
     },
     "functional-red-black-tree": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/functional-red-black-tree/-/functional-red-black-tree-1.0.1.tgz",
-      "integrity": "sha1-GwqzvVU7Kg1jmdKcDj6gslIHgyc=",
+      "integrity": "sha512-dsKNQNdj6xA3T+QlADDA7mOSlX0qiMINjn0cgr+eGHGsbSHzTabcIogz2+p/iqP1Xs6EP/sS2SbqH+brGTbq0g==",
       "dev": true
     },
     "gauge": {
       "version": "2.7.4",
       "resolved": "https://registry.npmjs.org/gauge/-/gauge-2.7.4.tgz",
@@ -1655,11 +1655,11 @@
       }
     },
     "imurmurhash": {
       "version": "0.1.4",
       "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
-      "integrity": "sha1-khi5srkoojixPcT7a21XbyMUU+o=",
+      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
       "dev": true
     },
     "inflight": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
@@ -1828,11 +1828,11 @@
       "integrity": "sha1-u5NdSFgsuhaMBoNJV6VKPgcSTxE="
     },
     "isexe": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha1-6PvzdNxVb/iUehDcsFctYz8s+hA=",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
       "dev": true
     },
     "jalaali-js": {
       "version": "1.2.6",
       "resolved": "https://registry.npmjs.org/jalaali-js/-/jalaali-js-1.2.6.tgz",
@@ -1875,11 +1875,11 @@
       "dev": true
     },
     "json-stable-stringify-without-jsonify": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
-      "integrity": "sha1-nbe1lJatPzz+8wp1FC0tkwrXJlE=",
+      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
       "dev": true
     },
     "json5": {
       "version": "2.2.1",
       "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.1.tgz",
@@ -2827,11 +2827,11 @@
       "integrity": "sha512-jGTwpFRexSH+fxappnGQtN9dspgE2ipa1aOjtR24igG0pv6JCxImIAmrLRHX+zUF5+1wtsFVbKyfP51kIGAVNw=="
     },
     "natural-compare": {
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
-      "integrity": "sha1-Sr6/7tdUHywnrPspvbvRXI1bpPc=",
+      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
       "dev": true
     },
     "node-addon-api": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-3.1.0.tgz",
diff --git a/package.json b/package.json
index df2a25b..552ad56 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "titra",
-  "version": "0.76.1",
+  "version": "0.77.0",
   "private": true,
   "scripts": {
     "start": "meteor run"
   },
   "dependencies": {
@@ -17,11 +17,11 @@
     "adm-zip": "^0.5.9",
     "bcrypt": "^5.0.1",
     "bootstrap": "^5.1.3",
     "content-type": "^1.0.4",
     "date-holidays": "^3.16.0",
-    "dayjs": "^1.11.2",
+    "dayjs": "^1.11.3",
     "dayjs-precise-range": "^1.0.1",
     "docker-names": "^1.2.1",
     "file-saver": "^2.0.5",
     "frappe-charts": "1.6.2",
     "frappe-datatable": "^1.16.3",
@@ -44,11 +44,11 @@
     "vm2": "^3.9.9"
   },
   "devDependencies": {
     "@babel/core": "^7.18.2",
     "@babel/eslint-parser": "^7.18.2",
-    "eslint": "^8.16.0",
+    "eslint": "^8.17.0",
     "eslint-config-airbnb-base": "^15.0.0",
     "eslint-import-resolver-meteor": "^0.4.0",
     "eslint-plugin-i18next": "^5.2.1",
     "eslint-plugin-import": "^2.26.0",
     "eslint-plugin-meteor": "^7.3.0"

Vulnerable code: METEOR@2.7.2
tunguska:reactive-aggregate@1.3.7
                labels: templateInstance.topTasks.get().map((task) => task._id),
        { name: t('globals.project'), editable: false, width: 2 },
        { name: t('globals.resource'), editable: false, width: 2 },
    entry.task,
        { name: t('globals.project'), editable: false },
        { name: t('globals.resource'), editable: false },
  validateEmail, getGlobalSetting, showToast,
                  labels: templateInstance.topTasks.get().map((task) => task._id),
              timecard.task.replace(/(:\S*:)/g, emojify),
    return `<span class="js-tooltip" data-bs-toggle="tooltip" data-bs-placement="left" title="${value}">${value}</span>`
    userId: projectUsers.findOne().users.find((elem) => elem._id === entry._id.userId)?.profile?.name,
      "version": "1.11.2",
      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.2.tgz",
      "integrity": "sha512-F4LXf1OeU9hrSYRPTTj/6FbO4HTjPKXvEIC1P2kcnFurViINCVk3ZV0xAS3XVx9MkMsXbbqlK6hjseaYbgKEHw=="
      "version": "8.16.0",
      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.16.0.tgz",
      "integrity": "sha512-MBndsoXY/PeVTDJeWsYj7kLZ5hQpJOfMYLsF6LicLHQWbRDG19lK5jOix4DPl8yY4SUFcE3txy86OzFLWT+yoA==",
      "integrity": "sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc=",
      "integrity": "sha1-GwqzvVU7Kg1jmdKcDj6gslIHgyc=",
      "integrity": "sha1-khi5srkoojixPcT7a21XbyMUU+o=",
      "integrity": "sha1-6PvzdNxVb/iUehDcsFctYz8s+hA=",
      "integrity": "sha1-nbe1lJatPzz+8wp1FC0tkwrXJlE=",
      "integrity": "sha1-Sr6/7tdUHywnrPspvbvRXI1bpPc=",
  "version": "0.76.1",
    "dayjs": "^1.11.2",
    "eslint": "^8.16.0",
Fixed code: METEOR@2.7.3
tunguska:reactive-aggregate@1.3.8
                labels: templateInstance.topTasks.get().map((task) => $('<span>').text(task._id).html()),
  addToolTipToTableCell,
        {
          name: t('globals.project'),
          editable: false,
          width: 2,
          format: addToolTipToTableCell,
        },
        {
          name: t('globals.resource'),
          editable: false,
          width: 2,
          format: addToolTipToTableCell,
        },
    entry.task.replace(/^=/, '='),
  addToolTipToTableCell,
        { name: t('globals.project'), editable: false, format: addToolTipToTableCell },
        { name: t('globals.resource'), editable: false, format: addToolTipToTableCell },
  validateEmail, getGlobalSetting, showToast, addToolTipToTableCell,
          format: addToolTipToTableCell,
                  labels: templateInstance.topTasks.get().map((task) => $('<span>').text(task._id).html()),
  addToolTipToTableCell,
              $('<span>').text(timecard.task.replace(/(:\S*:)/g, emojify)).html(),
    const sanitizedValue = $('<div/>').text(value).html()
    return `<span class="js-tooltip" data-bs-toggle="tooltip" data-bs-placement="left" title='${sanitizedValue}'>${sanitizedValue}</span>`
    userId: projectUsers
      .findOne().users.find((elem) => elem._id === entry._id.userId)?.profile?.name,
      "version": "1.11.3",
      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.3.tgz",
      "integrity": "sha512-xxwlswWOlGhzgQ4TKzASQkUhqERI3egRNqgV4ScR8wlANA/A9tZ7miXa44vTTKEq5l7vWoL5G57bG3zA+Kow0A=="
      "version": "8.17.0",
      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.17.0.tgz",
      "integrity": "sha512-gq0m0BTJfci60Fz4nczYxNAlED+sMcihltndR8t9t1evnU/azx53x3t2UHXC/uRjcbvRw/XctpaNygSTcQD+Iw==",
      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
      "integrity": "sha512-dsKNQNdj6xA3T+QlADDA7mOSlX0qiMINjn0cgr+eGHGsbSHzTabcIogz2+p/iqP1Xs6EP/sS2SbqH+brGTbq0g==",
      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
  "version": "0.77.0",
    "dayjs": "^1.11.3",
    "eslint": "^8.17.0",