Open chriswillsflannery opened 2 months ago
Bumps "decompress" package version. Versions < 4.2.1 are subject to an Arbitrary File Write exploit.
The security issue with decompress package should in theory be resolved with 4.2.1, and was resolved in the following PR: https://github.com/kevva/decompress/pull/73.
Without this version update, any packages consuming officeParser will surface a vulnerability warning (such as when running sec tools like Snyk) about decompress.
Bumps "decompress" package version. Versions < 4.2.1 are subject to an Arbitrary File Write exploit.
The security issue with decompress package should in theory be resolved with 4.2.1, and was resolved in the following PR: https://github.com/kevva/decompress/pull/73.
Without this version update, any packages consuming officeParser will surface a vulnerability warning (such as when running sec tools like Snyk) about decompress.