search

thiagobustamante / typescript-rest

This is a lightweight annotation-based expressjs extension for typescript.
MIT License
523 stars 110 forks source link

Requesting to upgrade few internal dependent packages which seems to have potential fixes reported in OSS CVE #161

Open mannerni opened 3 years ago

mannerni commented 3 years ago

Request to upgrade & known timeline for the same would help. 1) cookie: upgrade to 0.4.1 (Has Fix maxAge option to reject invalid values. Link: https://github.com/jshttp/cookie/releases/tag/v0.4.1.) 2) util: upgrade to 0.12.4. 3) string_decoder: upgrade to 1.3.0 4) readable-stream: upgrade to 3.6.0 Also would like to understand the impact when users do not use such code (above ones) directly, is it safe to say that internally also these package code is not used untill then?