search

DoctorMcKay / node-steam-client

API-compatible fork of node-steam's SteamClient
https://steamcommunity.com/groups/SteamRE/discussions/1/
MIT License
52 stars 19 forks source link

update package.json #19

Closed nyo closed 6 years ago

nyo commented 6 years ago

updated protobufjs to version 6.8.6 (and above) because of a vulnerability, see this hackerone report

DoctorMcKay commented 6 years ago

You can't just change version numbers like that. Protobuf.js version 6 introduces breaking changes and everything would need to be updated accordingly.

The vulnerability in question is minor in nature due to the fact that we don't parse untrusted proto files, so for now I'm not going to rush it.

nyo commented 6 years ago

well, sorry, i'm new to node.js and I thought it would be a good idea to report it, my bad :expressionless:

DoctorMcKay commented 6 years ago

I appreciate the report, I hadn't heard of the vulnerability and it's always good to look into them.