search

scottcorgan / tap-out

A different tap parser
MIT License
23 stars 28 forks source link

fix: bump version of the trim library, causing npm audit high severity warnings #46

Closed DavidVujic closed 3 years ago

DavidVujic commented 3 years ago

npm audit raises a high severity warning when installing the current version of the library tap-spec, and it is about the sub-dependency tap-out using an outdated version of the trim library.

Here's an issue in the zookeeper library, describing the problem: https://github.com/yfinkelstein/node-zookeeper/issues/276

This PR will solve npm audit issues in this repo.

I think the tap-spec library need to be updated after a new package has been released, though?

spencermountain commented 3 years ago

@scottcorgan anything we can do to help get this in? cheers

parkr commented 3 years ago

@scottcorgan Receiving this as well. Would love to get this merged and a new release sent out. Thanks!

martianboy commented 3 years ago

Got hit by this today. Would be great if this can be merged. ❤️

dgilperez commented 3 years ago

+1 over here, would love to see this security patch merged 🤟

spencermountain commented 3 years ago

I had no luck contacting the maintainer, so have created a respectful fork at tap-in

I added the 3 open PRs from this repo, updated the deps, and made some linting fixes. Otherwise plan to respect original goal of this library. Audit shows no more warnings. cheers

3cp commented 3 years ago

For the projects like this that the original author has no more interest to maintain, it would make sense to pass down the maintenance role to other contributor(s). @scottcorgan please.

Raynos commented 3 years ago

I don't have the ability to publish new versions, but I can merge this fix.