search

shawnbot / sast

Parse CSS, Sass, SCSS, and Less into a unist syntax tree
The Unlicense
49 stars 5 forks source link

Update yargs dependency #9

Open nikita-lysenko opened 4 years ago

nikita-lysenko commented 4 years ago

1 mem vulnerability found in package-lock.json

Propose to upgrade yargs to version 14.0.0 or later to get rid of required dependency "os-locale" which requires "mem" module with vulnerability.

Details: In nodejs-mem before version 4.0.0 there is a memory leak due to old results not being removed from the cache despite reaching maxAge. Exploitation of this can lead to exhaustion of memory and subsequent denial of service.

shawnbot commented 4 years ago

Thanks for this! Could you switch the whitespace back to 2 spaces in package.json, please?