search

apigee-127 / swagger-node-runner

The heart of Swagger-Node
MIT License
102 stars 123 forks source link

Known vulberabilites #126

Open adrbogacz opened 6 years ago

adrbogacz commented 6 years ago

Swagger node runner contains 2 know vulnerabilities in different dependence package, is any plan to use newer version of that packages?

theganyo commented 6 years ago

What are you referring to?

adrbogacz commented 6 years ago

https://github.com/nodesecurity/nsp I check my project with this tool and its report that you are using outdated debug package version with know vulnerability: https://nodesecurity.io/advisories/534

Additional some of Your dependencies also includes reported vulnerabilities.

GreensterRox commented 6 years ago

Hello I have the same issue,

I'm using Swagger https://www.npmjs.com/package/swagger which in turn uses swagger-connect version 0.1.0.

As I understand it swagger-connect is just a wrapper for this project swagger-node-runner.

When I use nsp: https://www.npmjs.com/package/nsp . it gives me the following vulnerabilities:

Any ideas how I can remove these vulnerabilities ?

Thanks !

theganyo commented 6 years ago

Yes. I suggest you upgrade. swagger-connect 0.1.0 is ancient, the current version is 0.7.0. The readme of this repo has information as to upgrading to a more modern version.

GreensterRox commented 6 years ago

Thank you for your response, if this version is so old, any ideas why it is being used as the default version when I run Swagger create project ?

theganyo commented 6 years ago

That's a good question, but one I can't properly answer. Here is the repo for that project: https://github.com/swagger-api/swagger-node. Perhaps they'd like help updating their templates to a recent version.