Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Release version with fixed audit issues #126

Open
pmoleri opened this issue Sep 15, 2021 · 0 comments
Open

Release version with fixed audit issues #126

pmoleri opened this issue Sep 15, 2021 · 0 comments

Comments

@pmoleri
Copy link

pmoleri commented Sep 15, 2021

When installing this package I get and audit report with 3 high vulnerabilities:

$ npm audit

  High            Prototype Pollution
  Package         lodash
  Patched in      >=4.17.11
  Dependency of   deps-ok
  Path            deps-ok > lodash
  More info       https://npmjs.com/advisories/782

  High            Prototype Pollution
  Package         lodash
  Patched in      >=4.17.12
  Dependency of   deps-ok
  Path            deps-ok > lodash
  More info       https://npmjs.com/advisories/1065

  Low             Prototype Pollution
  Package         lodash
  Patched in      >=4.17.19
  Dependency of   deps-ok
  Path            deps-ok > lodash
  More info       https://npmjs.com/advisories/1523

  High            Command Injection
  Package         lodash
  Patched in      >=4.17.21
  Dependency of   deps-ok
  Path            deps-ok > lodash
  More info       https://npmjs.com/advisories/1673

  Low             Prototype Pollution
  Package         minimist
  Patched in      >=0.2.1 <1.0.0 || >=1.2.3
  Dependency of   deps-ok
  Path            deps-ok > minimist
  More info       https://npmjs.com/advisories/1179

found 5 vulnerabilities (2 low, 3 high) in 13 scanned packages

These vulnerabilities are meaningless in a dev dependency like this, but still I'd like to get rid of them because it makes it harder to spot other important ones.

Any chance of releasing an updated version?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant