shawnbot / sast

Parse CSS, Sass, SCSS, and Less into a unist syntax tree
The Unlicense
49 stars 5 forks source link

Update yargs dependency #10

Open FRITS-Kh opened 4 years ago

FRITS-Kh commented 4 years ago

1 mem vulnerability found in package-lock.json

Propose to upgrade yargs to version 14.0.0 or later to get rid of required dependency "os-locale" which requires "mem" module with vulnerability.

Details: In nodejs-mem before version 4.0.0 there is a memory leak due to old results not being removed from the cache despite reaching maxAge. Exploitation of this can lead to exhaustion of memory and subsequent denial of service.

Replacing the PR #9 of @nikita-lysenko