Publish new version with recent changes to address security vulnerability

mannybecerra commented 2 years ago

Hi all,

I'm checking to confirm if the most current version of expr-eval is published to npm?

Last version appears to have been published 2-years ago, according to npm https://www.npmjs.com/package/expr-eval
There's a more current change here, https://github.com/silentmatt/expr-eval/blob/master/src/evaluate.js#L44, that appears to have come-in within the past 2-years
The change in reference appears to address an issue that we'd like to have, specifically, banning certain keywords, which will help address a security vulnerability issue that was raised by Dependabot and our Red Team

Please and thanks in advance!

johannesschobel commented 2 years ago

@silentmatt can we please have a new version? ;)

owocado commented 1 year ago

+1

although seeing no commits activity since a year makes me wonder if the repo owner is very busy with other projects/real life.

jorenbroekema commented 7 months ago

Since this repository is abandoned, https://www.npmjs.com/package/expr-eval-fork I published a fork with the latest commits as 2.0.2, so you can use this to fix the prototype pollution security issue.

silentmatt / expr-eval

Publish new version with recent changes to address security vulnerability #266