search

CodingZeal / eslint-config-zeal

Zeal's ESLint configuration
https://www.npmjs.com/package/eslint-config-zeal
MIT License
2 stars 2 forks source link

`mem` security warning #163

Closed sturdynut closed 5 years ago

sturdynut commented 5 years ago

This is to bring the mem security warning to attention. After following the yarn.lock it appears that this mem dependency is coming from the version of yargs that eslint-find-rules is using.

Here's the chain of dependencies that lead to the insecure package.

eslint-find-rules → yargs (v8.0.1) yargs (v8.0.1) → os-locale (v2.0.0) os-locale (v2.0.0) → mem (v^1.1.0")

I've submitted a PR to upgrade their version of yargs to the latest which should remove mem as a dependency entirely.

We should be able to upgrade our version of eslint-find-rules once this is merged and a new version is released.

randycoulman commented 5 years ago

eslint-find-rules is a dev-only dependency for this project, so not a huge issue for us, and certainly not an issue for our users. Thanks for bringing it up!