search

heapwolf / prompt-sync

a synchronous prompt for node.js
MIT License
211 stars 42 forks source link

Update dependency: solve security issue CVE-2021-3807 #52

Open magynhard opened 2 years ago

magynhard commented 2 years ago

The dependency strip-ansi 5.0.0 has another dependency that has a security issue.

By updating to strip-ansi 6.0.1 the coresponding dependency is updated as well.

Test is working fine with 6.0.1 but not 7.0.1, so i sticked to version 6.

Please bump the version and release a new npm version after accepting this pull request.

Security issue details:

image

CVE-2021-3807

caub commented 2 years ago

strip-ansi v7 is using ESM https://github.com/chalk/strip-ansi/releases/tag/v7.0.0, so yea good with ^6

@heapwolf can we merge this? do you want me to maintain this package btw?

caub commented 2 years ago

@davidmarkclements can we merge this please?