Closed slmoore closed 3 weeks ago
This is now a high severity issue and should be resolved ASAP.
Thanks
This is now a high severity issue and should be resolved ASAP.
Thanks
Hey, thanks for reminding us. We will tackle it in a release very soon.
This is now a high severity issue and should be resolved ASAP. Thanks
Hey, thanks for reminding us. We will tackle it in a release very soon.
Hey @tnolet, curious to know if there has been any movement on this? Thanks!
@bradbotcode sorry, this should have been part of the previous release, but slipped somehow. We are on it.
@bradbotcode @slmoore we just pushed 4.8.1 to NPM. It fixes this issue (and some others!).
Node.js version
20.12.1
NPM version
10.5.0
@checkly/cli version
4.6.3
Steps to reproduce
Hi Checkly team!
Running
npm i --save-dev checkly
is installing the dependencyip
with version2.0.0
andtar
with version6.2.0
. This introduces audit and dependabot alerts. https://github.com/advisories/GHSA-78xj-cgh5-2h22 https://github.com/advisories/GHSA-f5x3-32g6-xq36Steps to reproduce, on a clean repo without any dependencies or dev dependencies -
Here is the
npm audit report
Running
npm audit fix
results in the same audit errorsThanks!
What is expected?
The
ip
andtar
dependency versions would match the patched versions that are safe to use.What is actually happening?
The
ip
andtar
dependency versions are not the patched versions.Any additional comments?
No response