kentcdodds / kentcdodds/nps-utils
Security vulnerability in `concurrently` -> `tree-kill`
- Dominant language
- JavaScript
- Stars
- 98
- Forks
- 22
- PR merge metrics
- No merged PRs in 30d
Description
A security vulnerability has recently been reported for a nested dependency:
```nps-utils> concurrently > tree-kill```
https://npmjs.com/advisories/1432
Concurrently has updated it's dependencies to address the vulnerability:
https://github.com/kimmobrunfeldt/concurrently/releases/tag/v5.0.2
Updating to `concurrently@v5.0.2` ought to remediate the vulnerability.
I attempted to do so in a fork, but tests fail for me so I can't confidently make the updates.
Thank you for this great project along with `nps`, it's really brought clarity to npm scripts in my projects.
Contributor guide
Research direction
Start by locating the dependency declaration for nps-utils and reviewing the failed tests from the attempted concurrently update. Verify that upgrading to concurrently v5.0.2 resolves the nested tree-kill advisory, then run the project test suite and confirm it passes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100