search

danvk / source-map-explorer

Analyze and debug space usage through source maps
Apache License 2.0
3.82k stars 100 forks source link

security: use dependency `opn` instead of `open` #71

Closed eins78 closed 6 years ago

eins78 commented 6 years ago

see https://nodesecurity.io/advisories/663

fixes danvk/source-map-explorer#70

danvk commented 6 years ago

Thanks for the PR. I don't see how this could be exploited in SME, but it can't hurt to fix.

eins78 commented 6 years ago

Thanks for merging. I agree that there probably wasn't any danger, but in my case it popped up through npm audit and I generally like to keep my project free from any warnings. Since this package is recommended by create-react-app I figured a few others ran into the same warning. If anyone is in the same situation, the patched version can be used already before it is published to npm registry:

  "devDependencies": {
    "source-map-explorer": "git+https://github.com/danvk/source-map-explorer.git#b74f718"
  }