search

peter-murray / node-hue-api

Node.js Library for interacting with the Philips Hue Bridge and Lights
Apache License 2.0
1.18k stars 144 forks source link

axios vulnerbility #188

Closed jef closed 3 years ago

jef commented 3 years ago

Description

npmjs is reporting a vulnerability with <= axio@0.21.0. Are you able to bump node-hue-api to 4.0.10 with these changes before you release 5.0.0?

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Server-Side Request Forgery                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ axios                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.21.1                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ node-hue-api                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ node-hue-api > axios                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1594                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

Thanks!

peter-murray commented 3 years ago

4.0.10 has been published to the npm registry with the fixes applied