99x / 99x/serverless-dynamodb-local

Fix npm published version number

Open
#218 8 comments 8 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
621
Forks
232
PR merge metrics
No merged PRs in 30d

Description

**Actual Behaviour**

If you run `npm audit`

```sh
$ npm audit

=== npm audit security report ===

# Run npm install --save-dev serverless-dynamodb-local@1.0.2 to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ node.extend │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ serverless-dynamodb-local [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ serverless-dynamodb-local > dynamodb-localhost > rmdir > │
│ │ node.flow > node.extend │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/781 │
└───────────────┴──────────────────────────────────────────────────────────────┘
```
It advises you to instal:
`npm install --save-dev serverless-dynamodb-local@1.0.2`

**Expected Behaviour**

It should offer to install the verson `0.2.37` as that is the latest version of the package. This is because [npm registry version has `1.0.0`, `1.0.1` and `1.0.2` version published](https://www.npmjs.com/package/serverless-dynamodb-local?activeTab=versions) 3 years ago.

Screenshot 2019-04-07 at 08 47 02

**Steps to reproduce it**

run `npm audit`

**Would you like to work on the issue?**

May be, it require npm publish access to fix this issue.

Potential options:
1) Depricate npm releases `1.0.0`, `1.0.1` and `1.0.2`.
2) Release a new version `1.2.38`

I know that option 2 is against how semver works. In this case publishing those `1.x` version has lead to this issue. However this will set things on the right track for future releases. Essentially you are doing a fake release to realign semver releases.

Contributor guide

Open the contributing guide

Research direction

No repository file or test is named; start by reproducing the report with npm audit and checking the package's published version history. Review the two proposed registry actions and confirm completion when npm audit recommends the intended current package version instead of 1.0.2.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
release
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.