ramasilveyra / stylelint-images

Check your CSS images to improve the performance and avoid common mistakes (plugin pack).
MIT License
34 stars 7 forks source link

A new Security vulnerability detected with axios #22

Open mir4ef opened 3 years ago

mir4ef commented 3 years ago

Hi, it looks like there is a new High severity vulnerability with axios. Is it possible to update the version in this package, because the vulnerability cannot be fixed with npm audit fix?

                       === npm audit security report ===                        

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Server-Side Request Forgery                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ axios                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.21.1                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ stylelint-images [dev]                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ stylelint-images > axios                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1594                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
yhafez commented 3 years ago

Noticed this as well. I just updated the package.json and submitted a PR