search

jonschlinkert / git-branch

Get the current branch for a local git repository
https://github.com/jonschlinkert
MIT License
91 stars 16 forks source link

findup-sync v2 relies on insecure dependancies #11

Open carpiediem opened 4 years ago

carpiediem commented 4 years ago

Dependencies include kind-of v3 and braces v2. The current release of findup-sync is 4.0.0

https://github.com/jonschlinkert/git-branch/pull/12

tilman commented 1 year ago

As a workaround you can add this to your package.json (works with pnpm or yarn):

{
  ...
  "resolutions": {
    "findup-sync": "^4.0.0"
  }
  ...
}

The package seems to work with findup-sync 4.0.0 without any problems.