NPM: Fix Security Vulnerabilities

jsdoc2md / jsdoc-api

A programmatic interface for jsdoc3 with a few extra features

MIT License

61 stars 15 forks source link

NPM: Fix Security Vulnerabilities #16

Closed dargmuesli closed 5 years ago

dargmuesli commented 5 years ago

marked: Regular Expression Denial of Service [moderate] (https://npmjs.com/advisories/812)
js-yaml: Denial of Service [moderate] (https://npmjs.com/advisories/788)
js-yaml: Code Injection [high] (https://npmjs.com/advisories/813)
jsdoc-to-markdown: Prototype Pollution [high] (https://npmjs.com/advisories/755)

Note: there is a dependency loop with jsdoc-to-markdown so this PR doesn't solve all sec vulns. https://github.com/jsdoc2md/dmd/pull/75 needs to be merged first.

dargmuesli commented 5 years ago

JSDoc only supports NodeJS 8 and above. I think jsdoc2md can thus drop support for older Node versions.

75lb commented 5 years ago

thanks, released in jsdoc-api v5.