installing datum-sdk give me a warining about tar.gz being deprecated and vulnerable

Datum / datum-sdk

Datum Javascript API

https://developers.datum.org/

Other

15 stars 8 forks source link

installing datum-sdk give me a warining about tar.gz being deprecated and vulnerable #3

Open abumalick opened 5 years ago

abumalick commented 5 years ago

When installing last version of datim-sdk with yarn, I get the following line:

warning datum-sdk > web3 > web3-bzz > swarm-js > tar.gz@1.0.7: ⚠️  WARNING ⚠️ tar.gz module has been deprecated and your application is vulnerable. Please use tar module instead: https://npmjs.com/tar

is it really vulnerable because of this package ?

rhaenni commented 5 years ago

tar.gz is a dependency of web3 js, however we are not using the part of web3 that uses the deprecated tar.gz version so it's not an issue