Is download broken?

[erwinlauener]

Hi

I am very interested in installing eleventy garden. Neither installing the zip container-files nor the git clone works. This is what npm audit returns:

Thank you for installing EJS: built with the Jake JavaScript build tool (https://jakejs.com/)

added 415 packages from 398 contributors and audited 415 packages in 8.819s

11 packages are looking for funding run npm fund for details

found 1 high severity vulnerability

                   === npm audit security report ===                        

┌──────────────────────────────────────────────────────────────────────────────┐ │ Manual Review │ │ Some vulnerabilities require your attention to resolve │ │ │ │ Visit https://go.npm.me/audit-guide for additional guidance │ └──────────────────────────────────────────────────────────────────────────────┘ ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ High │ Server-Side Request Forgery │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ axios │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ >=0.21.1 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ @11ty/eleventy [dev] │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ @11ty/eleventy > browser-sync > localtunnel > axios │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://npmjs.com/advisories/1594 │ └───────────────┴──────────────────────────────────────────────────────────────┘ found 1 high severity vulnerability in 415 scanned packages 1 vulnerability requires manual review. See the full report for details.

Any suggestions? Thanks a lot. erwin

[binyamin]

@erwinlauener Thanks for checking in. You can just ignore this.

The reason for the error is that eleventy has a deep dependency (axios) which is outdated, and that old version has a security issue. As far as I know, we need to wait until the dependency which required axios (localtunnel) updates its own dependencies. See localtunnel/localtunnel#377

[erwinlauener]

Many thanks for your quick answer. I’ ll get it a new try soon.

erwinlauener

Am 05.01.2021 um 19:27 schrieb Binyamin Aron Green notifications@github.com:

 @erwinlauener Thanks for checking in. You can just ignore this.

The reason for the error is that eleventy has a deep dependency (axios) which is outdated, and that old version has a security issue. As far as I know, we need to wait until the dependency which required axios (localtunnel) updates its own dependencies. See localtunnel/localtunnel#377

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

[binyamin]

@erwinlauener should be totally fixed now.