search

SimulatedGREG / electron-vue

An Electron & Vue.js quick start boilerplate with vue-cli scaffolding, common Vue plugins, electron-packager/electron-builder, unit/e2e testing, vue-devtools, and webpack.
https://simulatedgreg.gitbooks.io/electron-vue/content/
MIT License
15.48k stars 1.55k forks source link

Replace multispinner with another one #924

Open h3poteto opened 5 years ago

h3poteto commented 5 years ago

Found an issue or bug with electron-vue? Tell me all about it!

Questions regarding how to use electron or vue are likely to be closed as they are not direct issues with this boilerplate. Please seek solutions from official documentation or their respective communities.

Describe the issue / bug.

Now lodash.merge has a security issue and lodash.merge is used in multispinner. There is a pull request to update lodash.merge in multispinner: https://github.com/codekirei/node-multispinner/pull/5

But it has not been merged yet, so the security issue is not fixed.

In electron-vue, mutlispinner is only used in build script.

I think that it is possible to replace multispinner with another spinner library, what do you think?

How can I reproduce this problem?

#

  1. vue init simulatedgreg/electron-vue my-project
  2. npm install
  3. npm audit
  4. The security issue is shown
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash.merge                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.6.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ multispinner [dev]                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ multispinner > lodash.merge                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1066                            │
Tell me about your development environment.

If you are looking to suggest an enhancement or feature, then feel free to remove everything above.