search

electron-userland / electron-compile

DEPRECATED: Electron supporting package to compile JS and CSS in Electron applications
1.01k stars 99 forks source link

Vulnerabilities #299

Open ScarletLovell opened 6 years ago

ScarletLovell commented 6 years ago

When using NPM i with electron-prebuilt-compile as a depend in my package.json, it follows up with these vulnerabilities

hoek has 4 errors on Prototype pollution https://nodesecurity.io/advisories/566

uglify-js has Incorrect Handling of Non-Boolean Comparisons During Minification & Regular Expression Denial of Service https://nodesecurity.io/advisories/39

Both seem to be through the electron-compilers nested depend

walterjohan commented 6 years ago

I get the same, is there any chance that these packages will be updated, or can we do that manually without breaking anything?