search

hughsk / vinyl-transform

Use standard text transform streams to write fewer gulp plugins
MIT License
55 stars 7 forks source link

Upgrade bl dependency to fix vulnerability #15

Open Lukenickerson opened 5 years ago

Lukenickerson commented 5 years ago

When including vinyl-transform in a project, this warning is given when running npm audit.

Moderate Memory Exposure
Package bl
Patched in >=0.9.5 <1.0.0 || >=1.0.1
Dependency of vinyl-transform [dev]
Path vinyl-transform > blc
More info https://nodesecurity.io/advisories/596

Details:

Overview Versions of bl before 0.9.5 and 1.0.1 are vulnerable to memory exposure.

bl.append(number) in the affected bl versions passes a number to Buffer constructor, appending a chunk of uninitialized memory

Remediation Update to version 0.9.5, 1.0.1 or later.