Skip to content
This repository has been archived by the owner on May 30, 2022. It is now read-only.

Upgrade all dependencies #26

Open
wants to merge 4 commits into
base: master
Choose a base branch
from

Conversation

andyjdavis
Copy link

@andyjdavis andyjdavis commented May 3, 2021

When I did 'npm install' in this repository I got a nasty warning about there being 4 low and 1 high priority vulnerabilities. It may or may not be important given the nature of the code in here but I thought it worth tidying up.

Running 'npm audit' produced this

# npm audit report

bl  <=1.2.2 || 2.0.1 - 2.2.0 || 3.0.0 || 4.0.0 - 4.0.2
Severity: high
Remote Memory Exposure - https://npmjs.com/advisories/1555
fix available via `npm audit fix`
node_modules/bl

lodash  <4.17.19
Prototype Pollution - https://npmjs.com/advisories/1523
fix available via `npm audit fix`
node_modules/lodash

minimist  <0.2.1 || >=1.0.0 <1.2.3
Prototype Pollution - https://npmjs.com/advisories/1179
fix available via `npm audit fix --force`
Will install mocha@8.3.2, which is a breaking change
node_modules/minimist
  mkdirp  0.4.1 - 0.5.1
  Depends on vulnerable versions of minimist
  node_modules/mkdirp
    mocha  1.21.5 - 6.2.2 || 7.0.0-esm1 - 7.1.0
    Depends on vulnerable versions of mkdirp
    node_modules/mocha

5 vulnerabilities (4 low, 1 high)

I have just optimistically pulled all dependencies up to their most recent versions.

'npm test' gave me all ticks both before and after making these changes.

'npm audit' now reports 0 vulnerabilities.

@CLAassistant
Copy link

CLAassistant commented May 3, 2021

CLA assistant check
All committers have signed the CLA.

@andyjdavis
Copy link
Author

Just checking in on this. There are new versions of some dev dependencies so I've bumped them. Tests still pass, 'npm audit' still reports zero vulnerabilities.

@andyjdavis
Copy link
Author

Another round of dependency bumps to get back to 0 vulnerabilities. Tests still pass.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants