Update `make-dir` to resolve vulnerable dependency
Open
Nobody has claimed this yet.
bug
- Dominant language
- JavaScript
- Stars
- 17k
- Forks
- 3.4k
- Avg merge
- 7h 42m
- Merged PRs (30d)
- 26
Description
the less.js dependency make-dir is not up-to-date and causes security warning due to its outdated dependency.
see https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
$ npm ls semver
less@4.1.3 project
└─┬ make-dir@2.1.0
└── semver@5.7.1
I would suggest updating to a current make-dir version here.
A quick search showed that it is only used here, so from my point of view an update should bring little problems.
https://github.com/less/less.js/blob/7491578403a5a35464772c730854c3a5169c0de7/packages/less/bin/lessc#L163-L172
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.