search

netlify-labs / react-netlify-identity

a tiny (4kb) React hook for using Netlify Identity, no UI. SEEKING MAINTAINERS
https://netlify-gotrue-in-react.netlify.com/
156 stars 25 forks source link

security: NPM audit fails due to outdated dependency #41

Open mobidev111 opened 4 years ago

mobidev111 commented 4 years ago

Current Behavior

currently used version of dependency tsdx fails the npm security audit:

 "tsdx": "^0.12.3",

https://github.com/sw-yx/react-netlify-identity/blob/master/package.json#L56

│ moderate │ Cross-Site Scripting │ │ Package │ serialize-javascript │ │ Patched in │ >=2.1.1

Expected behavior

no npm audit failure

Suggested solution(s)

upgrade to latest version of tsdx

Additional context

This prevents this library to be used in any security aware projects

mobidev111 commented 4 years ago

Same for "yargs-parser"