search

thibauts / node-castv2

An implementation of the Chromecast CASTV2 protocol
MIT License
765 stars 99 forks source link

Security Vulnerbility #54

Closed Hypnos3 closed 5 years ago

Hypnos3 commented 5 years ago

I have get an issue from @rgerrans. This issue is depending on the used protobuf version:

title

Is it possible to update the used version?

lacker commented 5 years ago

npm is starting to warn about the dependency here, too. Although since it's been a couple years since this repo has been updated, I won't hold my breath.

rgerrans commented 5 years ago

npm is starting to warn about the dependency here, too. Although since it's been a couple years since this repo has been updated, I won't hold my breath.

I ended up switching to https://github.com/Hypnos3/node-red-contrib-cast

dsteinman commented 5 years ago

Upgrading the dependency to 5.0.3 works, at least I didn't encounter anything that broke with this change yet.

"dependencies": {
    "debug": "^2.2.0",
    "protobufjs": "^5.0.3"
  },
Saiv46 commented 5 years ago

Any progress here? npm audit still reporting this vulnerable package.

feross commented 5 years ago

Hi everyone, I have a pull request that fixes this issue but I don't have a Chromecast handy at the moment to test it out. Can someone confirm that the code in this pull request still works correctly?

https://github.com/thibauts/node-castv2/pull/56

Hypnos3 commented 5 years ago

Thank you for the change. I can test not before end of next week.

feross commented 5 years ago

Fixed in castv2@0.1.10.