search

scottcorgan / tap-out

A different tap parser
MIT License
23 stars 28 forks source link

Fix high vulnerability on trim #49

Closed nicocube closed 2 years ago

nicocube commented 3 years ago

Hi, this is a quick update on dependency to fix npm audit:

                       === npm audit security report ===                        

# Run  npm install trim@1.0.1  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Regular Expression Denial of Service in trim                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ trim                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ trim                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ trim                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1700                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

# Run  npm update minimist --depth 2  to resolve 1 vulnerability
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ tape [dev]                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ tape > minimist                                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

found 2 vulnerabilities (1 low, 1 high) in 43 scanned packages
  run `npm audit fix` to fix 1 of them.
  1 vulnerability requires semver-major dependency updates.

I ran npm t and found no error.

Please merge, please. :)