launchdarkly / node-server-sdk

LaunchDarkly Server-side SDK for Node
Other
79 stars 65 forks source link

Vulnerability Detected in Node Dependency #97

Closed AlexisGlez closed 6 years ago

AlexisGlez commented 6 years ago

I ran some security reports in my application that now is using this node-client; the report found a High severity vulnerability in one of the dependencies of this module.

image

The fix should be very simple, just update the original dependency to version original@1.0.1.

Hopefully this won't be a breaking change.

More information in: https://snyk.io/test/npm/ldclient-node/5.0.1?tab=issues

jkodumal commented 6 years ago

Thanks @AlexisGlez -- this should be a relatively simple change that we'll try to address as soon as possible.

AlexisGlez commented 6 years ago

Thanks @jkodumal, really appreciate it 😄

eli-darkly commented 6 years ago

Rather than upgrading original I think we'll just drop it - we ended up not actually using that functionality.

eli-darkly commented 6 years ago

Fixed in version 5.0.2.