search

nelsonic / github-scraper

🕷 🕸 crawl GitHub web pages for insights we can't GET from the API ... 💡
434 stars 96 forks source link

npm audit found 2 high severity vulnerabilities #102

Closed nelsonic closed 5 years ago

nelsonic commented 5 years ago

While adding to the docs, I removed the dependencies and re-installed them:

$ rm -rf node_modules/
$ npm install

> pre-commit@1.2.2 install /Users/n/code/github-scraper/node_modules/pre-commit
> node install.js

pre-commit:
pre-commit: Detected an existing git pre-commit hook
pre-commit: Old pre-commit hook backuped to pre-commit.old
pre-commit:

> spawn-sync@1.0.15 postinstall /Users/n/code/github-scraper/node_modules/spawn-sync
> node postinstall

added 162 packages from 177 contributors and audited 265 packages in 4.121s
found 2 high severity vulnerabilities
  run `npm audit fix` to fix them, or `npm audit` for details

image

I think it's because the version of Cheerio we are using is kinda "old". https://david-dm.org/nelsonic/github-scraper image

We're using the "stable" version as opposed to the release candidate ... but it appears to be using older dependencies and hasn't been updated ...

Going to try and update Cheerio to 1.0.0-rc.3 and see if anything "breaks".

nelsonic commented 5 years ago

Only one parser fails after updating to cheerio@1.0.0-rc.3 ... 🎉 Going to publish a new version of the package with the latest Cheerio. :shipit:

nelsonic commented 5 years ago

github-scraper@6.8.0 on NPM uses the latest Cheerio and no longer has an npm audit warning. ✅