Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Newer versions after v0.7.7 causing npm moderate severity vulnerabilities #341

Open
Joolyan opened this issue Jun 3, 2023 · 3 comments
Open

Comments

@Joolyan
Copy link

Joolyan commented Jun 3, 2023

Installing the latest version (0.10.0) on macOS 11.7.7 generates the following issue...

got <11.8.5
Severity: moderate
Got allows a redirect to a UNIX socket - GHSA-pfrx-2q88-qq97
fix available via npm audit fix --force
Will install [email protected], which is a breaking change
node_modules/got
package-json <=6.5.0
Depends on vulnerable versions of got
node_modules/package-json
latest-version 0.2.0 - 5.1.0
Depends on vulnerable versions of package-json
node_modules/latest-version
update-notifier 0.2.0 - 5.1.0
Depends on vulnerable versions of latest-version
node_modules/update-notifier
posthtml-cli >=0.8.0
Depends on vulnerable versions of update-notifier
node_modules/posthtml-cli

Installing the latest version of got didn't resolve the vulnerabilities, but all okay using [email protected]

Any ideas as to what I've done wrong?

@Scrum
Copy link
Member

Scrum commented Sep 4, 2023

@Joolyan what versions of nodejs and npm are you using?

@Joolyan
Copy link
Author

Joolyan commented Sep 6, 2023

node v18.16.0
npm v9.5.1

@Scrum
Copy link
Member

Scrum commented Sep 7, 2023

Does not affect many dependencies. Needs to be corrected after the update. If you have the time and opportunity, I will gladly accept from you PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants