fix: update to @dabh/colors for security vuln

pouchdb / pouchdb-server

CouchDB-compatible server built on PouchDB and Node

Apache License 2.0

955 stars 154 forks source link

fix: update to @dabh/colors for security vuln #456

Closed mannyluvstacos closed 2 years ago

mannyluvstacos commented 2 years ago

A Security Vuln was identified in the Colors package for >1.4.0, offending packages being 1.4.1, 1.4.44-liberty

This PR updates the color package to using @dabh/colors as stated on this colors issue #317 which is a safe alternative.

ethnh commented 2 years ago

Hello Manny, This project has not had a significant commit in 3 years?

NPM has already removed the offending version ( https://www.npmjs.com/package/colors ) There is no need for this change 👍 This project is not compromised

mannyluvstacos commented 2 years ago

Hi Ethan!

I am curious to understand, does not having had significant commits in a certain time not warrant updating packages?

I was imagining folks who were making use of this version of pouchdb-server may want updates to packages that may not be playing nicely?