Closed pedrolamas closed 7 months ago
Small addendum to the above, I assume lodash.set
is in use to avoid bringing in the whole of lodash, however that is what tree-shaking is for and nowadays lodash is quite optimized for that!
Hello @pedrolamas, thanks for the heads up and the landed fix!
Summary
I've noticed the fs-tree-structure is using lodash.set which is 7 years old(!) and has been known to have a high severity vulnerability: https://github.com/advisories/GHSA-p6mc-m468-83gw
Reproduction steps
npm i skott
(this is the single package we need to install)npm audit
and observe resultsExpected result:
Audit should not report any known vulnerabilities.
Actual result:
Audit reports known vulnerability.
Details
Standard questions
Please answer these questions to help us investigate your issue more quickly:
skott
installed version?node -v
)?