search

cojs / co-body

Parse request bodies with co
MIT License
325 stars 42 forks source link

fix: bump package versions due to CVE-2022-24999 #83

Closed opravil-jan closed 7 months ago

atian25 commented 1 year ago

since co-body is using ^, the dep will auto-install the max version of minor as Semver rule, so maybe the updates are unnecessary.

opravil-jan commented 1 year ago

No it is not true. It only works when for example the current version would be "qs": "^6.0.0".

opravil-jan commented 1 year ago

It is documented here https://github.com/npm/node-semver#caret-ranges-123-025-004

atian25 commented 1 year ago

No it is not true. It only works when for example the current version would be "qs": "^6.0.0".

had you tried?

https://semver.npmjs.com/

image