Closed loremaps closed 3 years ago
graphql-upload
doesn't depend on the old vulnerable object-path
version:
^0.11.5
selects the latest 0.11.x
patch, which at the current moment installs a safe object-path
version; v0.11.7.
https://semver.npmjs.com is a useful tool to see what published version semver strings match.
If you delete your node_modules
and package-lock.json
file, and do a fresh npm install, you will see that graphql-upload
installs the latest object-path
version.
According to our container scanner, the
object-path
dependency has a critical vulnerability: