相依性套件的安全性問題
Open
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 3.7k
- Forks
- 486
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 16
Description
安裝套件會提示 critical severity
https://www.npmjs.com/package/@visactor/vtable?activeTab=versions
https://www.npmjs.com/package/@visactor/vdataset/v/1.0.6?activeTab=code
從 package-lock.json 中可得知
minimist -> geojson-flatten -> geojson-dissolve -> @visactor/vdataset
@visactor/vdataset
geojson-dissolve
geojson-flatten
想請問可以幫忙解決嗎？
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with package-lock.json and trace the reported minimist → geojson-flatten → geojson-dissolve → @visactor/vdataset chain, then review the linked npm package versions and severity details. Done means the critical dependency warning is resolved without breaking installation or the affected package relationships.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100