andrewrk / andrewrk/node-mv

Upgrade mkdirp due to vulnerability in old version

Aperta
#33 3 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
JavaScript
Stelle
156
Fork
18
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

Trying to work back through each node module for `bunyan` to fix a vulnerability.

`mkdirp@0.5.1` has a vulnerable package `minimist@0.0.8` which needs to be fixed. Updating to the latest version of `mkdirp` will completely remove `minimist` from the dependency tree.

Here's the CVE: https://nvd.nist.gov/vuln/detail/CVE-2020-7598

This library hasn't had any movement on it for quite a long time. If it's dead, say it's dead so I can discuss this with the maintainers of `bunyan`

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.