Closed mcandre closed 4 years ago
As a quick workaround, I am publishing "esformatter2" with all diff features temporarily removed:
@mcandre thanks for the heads up!
I'd just like to mention that publishing a esformatter2
on npm can be very misleading, I would suggest next time you fork a project to use a suffix instead so that it will be friendlier for people looking up on npm search, eg: esformatter-nodisparity
or something similar 👍
Please update or replace the "disparity" dependency, which GitHub reports as vulnerable due to its early diff Node.js package sub-dependency.
https://github.com/millermedeiros/disparity/issues/3
https://github.com/kpdecker/jsdiff/commit/2aec4298639bf30fb88a00b356bf404d3551b8c0
Alternatives:
One option would be to temporarily drop support for colors, treating the option as a NO-OP. This would allow a rapid security patch to be released, and then we can examine how to add back color support once a secure color diff dependency becomes available.