node-gyp < 4.0.0 has a vulnerability in the tar package dependency

[giamir]

You should consider upgrading to node-gyp version 4.0.0 which uses version 4.4.8 of the tar package and therefore it is patched.
nodejs/node-gyp@1456ef2

[nstepien]

Thanks for letting us know, we'll look into it asap.

[oohnoitz]

@MayhemYDG let's roll out https://dependabot.com/ on this repo. I don't have access but this will let us manage dependencies a bit better and automate some of the stuff for us.

[nstepien]

@giamir this is now fixed and published in version 2.4.3.

@oohnoitz we could look into it yeah.
GitHub has a similar feature, I wonder why it didn't notify me though:

[oohnoitz]

Well, opting for dependabot mostly cause it can create PRs for us and we'd just need to keep an eye on those instead.

[giamir]

Thanks a lot for the prompt fix. 👍

…

On 24 Apr 2019, 23:42 +0200, Hung Tran , wrote: Well, opting for dependabot mostly cause it can create PRs for us and we'd just need to keep an eye on those instead. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.