search

TooTallNate / superagent-proxy

`Request#proxy(uri)` superagent extension
154 stars 46 forks source link

Update chained dependencies #39

Closed juan-restrepo closed 3 years ago

juan-restrepo commented 3 years ago 
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ netmask npm package vulnerable to octal input data           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ netmask                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.0.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ superagent-proxy                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ superagent-proxy > proxy-agent > pac-proxy-agent >           │
│               │ pac-resolver > netmask                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1658                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

https://github.com/TooTallNate/node-pac-resolver/pull/25 takes care of the bottom one. Once it's merged, I can start bubbling it up

juan-restrepo commented 3 years ago

Patch version update to pac-resolver bubbled it up on its own. This vulnerability is gone!