You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hello! First ever issue here, reporting two identical notices from npm audit about a low-severity vulnerability in one of your package's dependencies that I noticed today.
Specifically, it's complaining about minimist which was a dependency of mkdirp, but the latest version of mkdirp doesn't rely on minimist at all any more (isaacs/node-mkdirp#27). Would it be possible to upgrade pixl-tools to a more recent version of mkdirp and cut out the middleman, as it were?
Thank you so much for your work on pixl-canvas-plus! It works amazingly and even someone like me, without a lot of experience in programming, was able to understand how to use it. 💙
=== npm audit security report ===
Manual Review
Some vulnerabilities require your attention to resolve
Visit https://go.npm.me/audit-guide for additional guidance
Low Prototype Pollution
Package minimist
Patched in >=0.2.1 <1.0.0 || >=1.2.3
Dependency of pixl-canvas-plus
Path pixl-canvas-plus > pixl-cli > pixl-tools > mkdirp > minimist
More info https://npmjs.com/advisories/1179
Low Prototype Pollution
Package minimist
Patched in >=0.2.1 <1.0.0 || >=1.2.3
Dependency of pixl-canvas-plus
Path pixl-canvas-plus > pixl-tools > mkdirp > minimist
More info https://npmjs.com/advisories/1179
found 2 low severity vulnerabilities in 579 scanned packages
2 vulnerabilities require manual review. See the full report for details.
The text was updated successfully, but these errors were encountered:
Hello! First ever issue here, reporting two identical notices from
npm audit
about a low-severity vulnerability in one of your package's dependencies that I noticed today.Specifically, it's complaining about minimist which was a dependency of mkdirp, but the latest version of mkdirp doesn't rely on minimist at all any more (isaacs/node-mkdirp#27). Would it be possible to upgrade pixl-tools to a more recent version of mkdirp and cut out the middleman, as it were?
Here's the npm advisory on it: https://npmjs.com/advisories/1179
Thank you so much for your work on pixl-canvas-plus! It works amazingly and even someone like me, without a lot of experience in programming, was able to understand how to use it. 💙
The text was updated successfully, but these errors were encountered: