search

wooorm / franc

Natural language detection
https://wooorm.com/franc/
MIT License
4.07k stars 175 forks source link

npm i franc results in 1 high severity vulnerability upon install #98

Closed snapdeus closed 2 years ago

snapdeus commented 3 years ago

Greetings,

I installed npm franc and it resulted in "1 high severity vulnerability" in the npm audit.

See attached screenshot image

Upon examining the package.json for the dependencies, it has "trigram-utils": "^1.0.0" - whjch installs a vulnerable version of trim.

I was able to fix this by changing the package.json to require the 2.0 version of trigram utils and it was fine.

Just thought you should be aware!

Thank you for your time.

wooorm commented 3 years ago

Updating to v2 would break everything, as that’s an ESM package.

No need to worry about trim. It’s a potential slowdown. Not anything that would actually affect you.

wooorm commented 2 years ago

Duplicate of GH-101 and solved in 6.0.0