Skip to content

Updated request to avoid security vulnerability in dep #20

New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Closed
wants to merge 1 commit into from

Conversation

rankida
Copy link

@rankida rankida commented Jul 18, 2018

Hi,

Older versions of hoek have a security vulnerability https://snyk.io/vuln/npm:hoek:20180212 and this is pulled in by old versions of request.

This PR simply bumps request to to 2.87.0 (from 2.81.0) to avoid this issue.

Please let me know if I have done anything wrong with this PR.

Thanks!

@rankida rankida requested a review from a team as a code owner July 18, 2018 09:39
@zkat
Copy link
Contributor

zkat commented Jul 18, 2018

We are intentionally not upgrading request to 2.87.0 until node-gyp gets around to unpinning that package. We can't really do much about it being in our tree, and having the toplevel request be a different version than what node-gyp uses is significantly increasing the package size for our distributed tarball.

As far as we're concerned, the issues with hoek do not pose a risk to npm itself, which is why we decided to let the audit be a little noisy for now.

You wanna try and convince the node-gyp folks to fix that bit? :)

@zkat
Copy link
Contributor

zkat commented Jul 19, 2018

I'm gonna actually close this, and there's also a more thorough answer on the discussion board: https://npm.community/t/npm-i-npm-6-2-0-latest-shows-security-noise/709/3

tl;dr you're safe. Like, for sure.

@zkat zkat closed this Jul 19, 2018
@rankida
Copy link
Author

rankida commented Jul 19, 2018

Thanks for taking the time to reply.

Cheers!

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants