search

foundation / panini

A super simple flat file generator.
Other
592 stars 104 forks source link

Panini depends on vulnerable version of Handlebars? #204

Closed lukos closed 4 years ago

lukos commented 4 years ago

The following vuln relates to Handlebars prior to version 4.3: https://nvd.nist.gov/vuln/detail/CVE-2019-19919, Panini depends on ^4.0.5.

If you agree that this version creates a vulnerability, please update the dependency of Handlebars to a later version.

DanielRuf commented 4 years ago

Panini depends on ^4.0.5.

This will automatically use the latest 4.x version. See https://semver.npmjs.com/

grafik

We are already aware of this, see https://github.com/foundation/panini/pull/197

lukos commented 4 years ago

Great thanks. I guess I need to npm update somewhere.