search

gleam-lang / vscode-gleam

📟 Gleam support for VS Code
Apache License 2.0
150 stars 30 forks source link

Dependencies have `2 moderate severity vulnerabilities` and use deprecated `vsce` package #84

Closed hamirmahal closed 1 month ago

hamirmahal commented 2 months ago

npm audit report

xml2js <0.5.0 Severity: moderate xml2js is vulnerable to prototype pollution - https://github.com/advisories/GHSA-776f-qx25-q3cc fix available via npm audit fix --force Will install vsce@1.97.0, which is a breaking change node_modules/xml2js vsce >=1.98.0-alpha.0 Depends on vulnerable versions of xml2js node_modules/vsce

2 moderate severity vulnerabilities

hamirmahal commented 2 months ago 
$   npm install
npm WARN deprecated vscode-test@1.6.1: This package has been renamed to @vscode/test-electron, please update to the new name
npm WARN deprecated vsce@2.15.0: vsce has been renamed to @vscode/vsce. Install using @vscode/vsce instead.

added 425 packages, and audited 426 packages in 2s

83 packages are looking for funding
  run `npm fund` for details

2 moderate severity vulnerabilities
hamirmahal commented 2 months ago

image