CVE-2022-33987 - Githubissues

yeoman / update-notifier

Update notifications for your CLI app

BSD 2-Clause "Simplified" License

1.76k stars 132 forks source link

CVE-2022-33987 #218

Closed danepowell closed 2 years ago

danepowell commented 2 years ago

This package should update its dependency on latest-version to at least v6.0.0 to fix a downstream vulnerability in got. See https://github.com/remy/nodemon/issues/2023 for details.

erunion commented 2 years ago

@sindresorhus Can you update latest-version in the 5.x tag series as well? There are a lot of packages out here that are using it and can't just upgrade to ESM.

ryanblock commented 2 years ago

Since ensuring the safety and security of developers who cannot change to ESM has not been a priority for this project, I've created a fork here: https://www.npmjs.com/package/update-notifier-cjs

No meaningful logic changes have occurred to this library since making the change to ESM; this forked version is just 5.x, but with with two other Sindre dependencies vendored so as to enable making use of the got patch that addresses CVE-2022-33987.