search

rafgraph / rollpkg

Zero-config build tool to create packages with Rollup and TypeScript
MIT License
175 stars 8 forks source link

Vulnerabilities #15

Closed DiamondeX closed 3 years ago

DiamondeX commented 3 years ago

Creating a template according to provided instructions (after Install rollpkg and typescript) gives the following message:

15 vulnerabilities (2 low, 5 moderate, 8 high)

The same output you can get with npm audit.

Are there any plans to fix this?

Otherwise, I like this tool and the approaches used in it and would like to use it

DiamondeX commented 3 years ago

Looks like all of the vulnerabilities are coming from package-build-stats for the BundlePhobia usage.

rafgraph commented 3 years ago

I don’t believe any of these can be exploited when used in a non-server context where the user controls the input.

Are there any specific vulnerabilities that you’re worried about in the context of Rollpkg?

Also, I’d suggest opening an issue with the package-build-stats library as this is an upstream issue.

DiamondeX commented 3 years ago

Agree. Then you can close this issue