Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Low-severity vulnerability in dependency #4

Closed
lacoeur opened this issue Jul 29, 2020 · 1 comment
Closed

Low-severity vulnerability in dependency #4

lacoeur opened this issue Jul 29, 2020 · 1 comment

Comments

@lacoeur
Copy link

lacoeur commented Jul 29, 2020

Hello! First ever issue here, reporting two identical notices from npm audit about a low-severity vulnerability in one of your package's dependencies that I noticed today.

Specifically, it's complaining about minimist which was a dependency of mkdirp, but the latest version of mkdirp doesn't rely on minimist at all any more (isaacs/node-mkdirp#27). Would it be possible to upgrade pixl-tools to a more recent version of mkdirp and cut out the middleman, as it were?

Here's the npm advisory on it: https://npmjs.com/advisories/1179

Thank you so much for your work on pixl-canvas-plus! It works amazingly and even someone like me, without a lot of experience in programming, was able to understand how to use it. 💙

                       === npm audit security report ===                        
                                                                                
                                                                                
                                 Manual Review                                  
             Some vulnerabilities require your attention to resolve             
                                                                                
          Visit https://go.npm.me/audit-guide for additional guidance           
                                                                                
                                                                                
  Low             Prototype Pollution                                           
                                                                                
  Package         minimist                                                      
                                                                                
  Patched in      >=0.2.1 <1.0.0 || >=1.2.3                                     
                                                                                
  Dependency of   pixl-canvas-plus                                              
                                                                                
  Path            pixl-canvas-plus > pixl-cli > pixl-tools > mkdirp > minimist  
                                                                                
  More info       https://npmjs.com/advisories/1179                             
                                                                                
                                                                                
  Low             Prototype Pollution                                           
                                                                                
  Package         minimist                                                      
                                                                                
  Patched in      >=0.2.1 <1.0.0 || >=1.2.3                                     
                                                                                
  Dependency of   pixl-canvas-plus                                              
                                                                                
  Path            pixl-canvas-plus > pixl-tools > mkdirp > minimist             
                                                                                
  More info       https://npmjs.com/advisories/1179                             
                                                                                
found 2 low severity vulnerabilities in 579 scanned packages
  2 vulnerabilities require manual review. See the full report for details.
@jhuckaby
Copy link
Owner

All fixed, thanks!

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants