the minimist v1.2.5 package has critical dependency issue. This needs to be updated to 1.2.6

dpa99c / cordova-diagnostic-plugin

Cordova/Phonegap plugin to manage device settings

539 stars 361 forks source link

the minimist v1.2.5 package has critical dependency issue. This needs to be updated to 1.2.6 #467

Closed michael-roewin closed 2 years ago

michael-roewin commented 2 years ago

Findings

When doing npm audit, a critical vulnerability issue that's related to the cordova diagnostic plugin appears.

Screenshots

dvag-lukas-rybacki commented 2 years ago

@michael-roewin already fixed in #464

michael-roewin commented 2 years ago

thanks so much @dvag-lukas-rybacki . Are you going to create a new tag for this fix?

dvag-lukas-rybacki commented 2 years ago

@michael-roewin i am also waiting for a new release @dpa99c

peitschie commented 2 years ago

As an interim fix, you can install the dependency directly from github instead (there appears to be no compile steps needed here):

npm install --save https://github.com/dpa99c/cordova-diagnostic-plugin.git

But definitely looking forward to a new release 😸

dvag-lukas-rybacki commented 2 years ago

Thats true @peitschie . Thanks for the alternative idea and also looking forward to new release though 😄

dpa99c commented 2 years ago

This has been fixed in the major version cordova.plugins.diagnostic@7.0.0 which has just been released to npm. Please re-test with this new version and feedback any issues.