strongloop / strong-remoting

Communicate between objects in servers, mobile apps, and other servers.
www.strongloop.com
Other
105 stars 93 forks source link

Upgrade dependencies to fix security vulnerabilities (2.x) #447

Closed bajtos closed 6 years ago

bajtos commented 6 years ago

This fix is needed to make npm test in loopback-workspace pass again. Right now, applications scaffolded for LB 2.x are failing their npm test because of security vulnerabilities reported by nsp check.

bajtos commented 6 years ago

Please note that the latest versions of jscs & jshint are depending on a lodash version that's vulnerable to Prototype Pollution. Since these are dev-dependencies, I think we don't need to worry.

If we wanted to fix the problem, we would have to migrate from jshint+jscs to eslint+eslint-config-loopback.