search

davglass / license-checker

Check NPM package licenses
Other
1.59k stars 215 forks source link

npm audit warning from minimist dependency #235

Open MartinHignett opened 4 years ago

MartinHignett commented 4 years ago

We have an npm audit warning when including this library in our dev dependencies:

│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.2.1 <1.0.0 || >=1.2.3                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ license-checker                                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ license-checker > mkdirp > minimist                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

It looks like we need to update the mkdirp dependency to 0.5.3 or later.