cockroachdb / cockroachdb/examples-orms

`npm` reports Sequelize vulnerability

未關閉
#62 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
Go
星號
82
分支
37
PR 合併指標
30 天內沒有已合併 PR

描述

Looks like we need to upgrade the version (apologies for not PR'ing that change, wanted to at least file the issue). However perhaps I'm not understanding this correctly, as I'm not really a JS developer.

```sh
$ cd examples-orms/node/sequelize
$ npm install
added 112 packages from 146 contributors and audited 226 packages in 2.523s
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details

╭───────────────────────────────────────────────────────────────╮
│ │
│ New minor version of npm available! 6.5.0 → 6.9.0 │
│ Changelog: https://github.com/npm/cli/releases/tag/v6.9.0 │
│ Run npm i -g npm to update! │
│ │
╰───────────────────────────────────────────────────────────────╯

$ npm audit
=== npm audit security report ===

# Run npm install sequelize@5.7.4 to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ NoSQL Injection │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ sequelize │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ sequelize │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ sequelize │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/820 │
└───────────────┴──────────────────────────────────────────────────────────────┘

found 1 high severity vulnerability in 226 scanned packages
1 vulnerability requires semver-major dependency updates.

$ npm audit fix
up to date in 0.42s
fixed 0 of 1 vulnerability in 226 scanned packages
1 package update for 1 vuln involved breaking changes
(use `npm audit fix --force` to install breaking changes; or refer to `npm audit` for steps to fix these manually)
```

貢獻指南

這個儲存庫沒有索引到貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。