search

nswbmw / koa-mongo

MongoDB middleware for koa, support connection pool.
145 stars 31 forks source link

Use deprecated version 4.1.1 of package debug #45

Closed fgeorges closed 3 years ago

fgeorges commented 3 years ago

Hi,

I have just installed koa-mongo through NPM, and got a warning about debug 4.1.1 being deprecated:

$ npm i koa-mongo
npm WARN deprecated debug@4.1.1: Debug versions >=3.2.0 <3.2.7 || >=4 <4.3.1 have a low-severity ReDos regression when used in a Node.js environment. It is recommended you upgrade to 3.2.7 or 4.3.1. (https://github.com/visionmedia/debug/issues/797)

added 5 packages, changed 1 package, and audited 148 packages in 3s

found 0 vulnerabilities
$ npm -v
7.3.0
$ node -v
v15.5.1
$

Apart from debug (and a minor update for mongodb,) dependencies seem quite up-to-date though. This is in package.json:

"debug": "4.1.1",
"generic-pool": "3.7.1",
"mongodb": "3.6.1",
"muri": "1.3.0"

And these are the current versions:

"debug": "4.3.1",
"generic-pool": "3.7.1",
"mongodb": "3.6.3",
"muri": "1.3.0"

It might be good to bump debug dependency version?

fgeorges commented 3 years ago

Thank you, I confirm all is fine after re-installing!