search

ngokevin / angle

:clock430: A-Frame command-line tool for installing components and scaffolding templates.
https://www.npmjs.com/package/angle
MIT License
80 stars 20 forks source link

Severe Security Issues in Component Dependencies #46

Open crcdng opened 5 years ago

crcdng commented 5 years ago

I just pushed a component made with angle to Github and got the following security issues, all from dev-dependencies in the generated component.

screenshot 2018-12-08 01 31 41

Many of the dependencies are deprecated.

npm WARN deprecated minimatch@1.0.0: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated to-iso-string@0.0.2: to-iso-string has been deprecated, use @segment/to-iso-string instead.
npm WARN deprecated jade@0.26.3: Jade has been renamed to pug, please install the latest version of pug instead of jade
npm WARN deprecated formatio@1.1.1: This package is unmaintained. Use @sinonjs/formatio instead
npm WARN deprecated wrench@1.5.8: wrench.js is deprecated! You should check out fs-extra (https://github.com/jprichardson/node-fs-extra) for any operations you were using wrench for. Thanks for all the usage over the years.
npm WARN deprecated minimatch@0.3.0: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated minimatch@2.0.10: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated circular-json@0.5.9: CircularJSON is in maintenance only, flatted is its successor.
npm WARN deprecated circular-json@0.3.3: CircularJSON is in maintenance only, flatted is its successor.
ngokevin commented 5 years ago

Thanks, those dependencies are only used in the backend or some sub-subpackage, so it's not as severe as GitHub reports.

Deprecations and renames aren't too critical either, if it works it works. If we had to update every time some a sub-sub-subpackage screamed, we'd be quite busy xD

PRs accepted though.