search

atais / ng2-eonasdan-datetimepicker

A wrapper directive around the Eonasdan Datepicker v4 component.
MIT License
34 stars 23 forks source link

jQuery dependency has security vulnerabilities. #62

Closed benjaminrlawrence closed 5 years ago

benjaminrlawrence commented 5 years ago

When installing using node v10.15.1, I am notified of a security vulnerability related this package's dependency on jQuery (^1.8.3 || ^2.0). Can this be updated to include jQuery ^3.0? The eonodasan bootstrap datetime picker allows that version of jQuery.

atais commented 5 years ago

The eonodasan bootstrap datetime picker allows that version of jQuery.

I may have outdated info but does it?

atais commented 5 years ago

Yeah it only does in the latest version 4.17.47 We need to bump this as well in the project, currently 4.17.22 and release new version of this lib

https://github.com/Eonasdan/bootstrap-datetimepicker/commits/master/package.json

https://github.com/Eonasdan/bootstrap-datetimepicker/commit/646299ff633307c0375048efd3169631ba49c0b3#diff-b9cfc7f2cdf78a7f4b91a753d10865a2 https://github.com/Eonasdan/bootstrap-datetimepicker/commit/25c11d79e614bc6463a87c3dd9cbf8280422e006#diff-b9cfc7f2cdf78a7f4b91a753d10865a2

benjaminrlawrence commented 5 years ago

Thanks for getting on this. Can you let me know when you have the new version of this package published to npm? You're current package.json points to "eonasdan-bootstrap-datetimepicker": ">=4.17.22 <5.0.0", so while it's probably a good idea to update that as well, npm grabbed 4.17.44. I'll close this issue when you have the new package up on npm.

atais commented 5 years ago

sorry it took so long

https://www.npmjs.com/package/ng2-eonasdan-datetimepicker