kentcdodds / kentcdodds/nps-utils

Security vulnerability in `concurrently` -> `tree-kill`

Open
#44 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
98
Forks
22
PR merge metrics
No merged PRs in 30d

Description

A security vulnerability has recently been reported for a nested dependency:
```nps-utils> concurrently > tree-kill```
https://npmjs.com/advisories/1432

Concurrently has updated it's dependencies to address the vulnerability:
https://github.com/kimmobrunfeldt/concurrently/releases/tag/v5.0.2

Updating to `concurrently@v5.0.2` ought to remediate the vulnerability.
I attempted to do so in a fork, but tests fail for me so I can't confidently make the updates.

Thank you for this great project along with `nps`, it's really brought clarity to npm scripts in my projects.

Contributor guide

Open the contributing guide

Research direction

Start by locating the dependency declaration for nps-utils and reviewing the failed tests from the attempted concurrently update. Verify that upgrading to concurrently v5.0.2 resolves the nested tree-kill advisory, then run the project test suite and confirm it passes.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.