mathiasbynens / mathiasbynens/he
npm audit: 26 vulnerabilities
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 3.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Description
The latest version of "he" contains some vulnerabilities according to "npm audit":
26 vulnerabilities (8 moderate, 9 high, 9 critical)
I'm not using this package directly but instead it is being referenced through mocha (and I'm using mocha). But I'm just seeing if this project is active enough that perhaps these vulnerabilities will be addressed at some point. I'm certainly no expert with this but it appears that the vulnerabilities are related to packages that need upgrading to newer versions.
I think just having newer packages that update the lodash version will satisfy my vulnerability scanner.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by running npm audit and inspect the dependency chain through mocha, especially the packages identified as vulnerable. Review the dependency declarations and confirm the project’s existing test command; done means the reported vulnerabilities are resolved without breaking the test suite.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100