Closed dead-claudia closed 2 years ago
Most if not all people are using prebuildify-cross
in CI, which (correct me if I'm wrong) is not an environment in which ReDoS vulnerabilities matter. Similarly, if you are using prebuildify-cross
locally, I doubt these vulnerabilities can do any harm because every input is yours. If you are using prebuildify-cross
in a public-facing server, taking user input, then I'd say it's your responsibility to sanitize user input (etc).
That said, if updating dependencies here can remove the vulnerabilities, then a PR is welcome.
Output of
npm audit
docker-run
was over 5 years ago. It may be best to fork the dependency and/or reimplement it locally.trim-newlines
didn't install the latest version.npm audit fix
doesn't address it, though.