search

jfromaniello / selfsigned

Generate self-signed certificates from node.js
MIT License
237 stars 53 forks source link

release 1.10.14 vulnerability node-forge #60

Closed artola closed 2 years ago

artola commented 2 years ago

Released package v1.10.13 contains "node-forge": "^1.2.0" ... but the next release v.1.10.14 contains "node-forge": "^0.10.0".

Is this because of a rollback due some problem in the upgrade? If it works, it work be great to release a 1.10.* with the fixed dependency.

artola commented 2 years ago

Found reasoning at: https://github.com/jfromaniello/selfsigned/issues/52#issuecomment-1029151046

My problem is caused by webpack-dev-server@npm:3.11.3 ==> "selfsigned": "^1.10.8",

Solved with:

"resolutions": {
  "webpack-dev-server/selfsigned": "^2.0.1"
}

I will try to eliminate the dependency that pulls in webpack-dev-server v3.