loopbackio / loopbackio/loopback-connector-openapi
insecure package dependency
Open
Nobody has claimed this yet.
bug
- Dominant language
- JavaScript
- Stars
- 8
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Description
This project has a nested dependency validator@12, this has a security vulnerability https://avd.aquasec.com/nvd/cve-2021-3765. It needs updating to 13.7.0.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the dependency manifest or lockfile that brings in nested validator@12, then inspect how it resolves in this project. Update the dependency so validator resolves to 13.7.0 and confirm the vulnerable version is no longer present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100