search

TooTallNate / node-degenerator

Turns sync functions into async functions
20 stars 17 forks source link

[Security]: update VM2 to 3.9.17 #25

Closed zakuru closed 1 year ago

zakuru commented 1 year ago

https://github.com/patriksimek/vm2/releases/tag/3.9.17

pablospaniard commented 1 year ago

@TooTallNate it seems that you have the power to update all the packages: proxy-agent, pac-proxy-agent, pac-resolver, degenerator. Please do it ASAP :) Thank you in advance.

zakuru commented 1 year ago

Thanks @TooTallNate 👍

TooTallNate commented 1 year ago

I'll do a release for this, but honestly it's not necessary since the semver range on this dependency is already loose enough to allow for the updated version to be installed. Just update your lockfile in your project.

zakuru commented 1 year ago

I'll do a release for this, but honestly it's not necessary since the semver range on this dependency is already loose enough to allow for the updated version to be installed. Just update your lockfile in your project.

You are correct as long as the users do as you said the right version of VM2 will be taken

/workspaces/node-proxy-agent (master) $ npm ls vm2
proxy-agent@5.0.0 /workspaces/node-proxy-agent
└─┬ pac-proxy-agent@5.0.0
  └─┬ pac-resolver@5.0.1
    └─┬ degenerator@3.0.3
      └── vm2@3.9.17

Probably no need power upgrade for all Thanks for the follow up 👍