search

TritonDataCenter / node-http-signature

Reference implementation of Joyent's HTTP Signature Scheme
https://tritondatacenter.com
MIT License
405 stars 118 forks source link

Security warning (high) due to dev dep on tap #114

Open PieterBreugelmans opened 4 years ago

PieterBreugelmans commented 4 years ago

npm audit of http-signature@1.3.4

High Regular Expression Denial of Service

Package minimatch

Dependency of tap [dev]

Path tap > glob > minimatch

More info https://npmjs.com/advisories/118

Root cause is dev dependency on tap in https://github.com/joyent/node-http-signature/blob/master/package.json

  "devDependencies": {
    "tap": "0.4.2",

Requires tap@12.0.2 or higher to fix the issue.