Update `latest-version` package, removing vulnerability.

yeoman / update-notifier

Update notifications for your CLI app

BSD 2-Clause "Simplified" License

1.76k stars 132 forks source link

Update `latest-version` package, removing vulnerability. #152

Closed NessDan closed 5 years ago

NessDan commented 5 years ago

There's a vulnerability with the package deep-extend, which is a sub-child of the latest-version package. The vulnerability exists on v3.0.0 (what update-master is currently using) but is fixed in v3.1.0 (this PR.)

Upgrading it by a minor version fixes the issue.

screen shot 2019-03-07 at 11 51 29 am

sindresorhus commented 5 years ago

This has been fixed in master. We'll do a new release when https://github.com/yeoman/update-notifier/issues/153 has been fixed and the open PRs have been merged.