Old npm version has security vulnerabilities - update to ~> v7.0.0 - Githubissues

Tim-B / grunt-aws-lambda

A grunt plugin to assist in developing functions for AWS Lambda.

MIT License

247 stars 100 forks source link

Old npm version has security vulnerabilities - update to ~> v7.0.0 #120

Open kannapples opened 2 years ago

kannapples commented 2 years ago

This package is running a really old version of npm (2.15.12 while current is 7.24.0), which has a known security vulnerability in its dependencies.

One of my projects received a dependabot security warning about tar package versions below 4.4.16. This package is currently using tar 2.2.1 through the npm package.

I tracked the minimum npm version required to plug this security hole: v7.0.0

node-gyp needs to be at least v7.0.0 to pull in this commit which upgrades the tar version to ~> 4.4.16.
npm removes the outdated node-gyp dependency and has a secure tar version in this commit, which is part of the v7.0.0 release: https://github.com/npm/cli/blob/v7.0.0/package.json