Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

vulnerability issue with inflight @1.0.6 #277

Open
KusumaShekarN opened this issue Jul 6, 2021 · 5 comments
Open

vulnerability issue with inflight @1.0.6 #277

KusumaShekarN opened this issue Jul 6, 2021 · 5 comments
Labels
pinned Issues that will not be automatically closed

Comments

@KusumaShekarN
Copy link

The package inflight @1.0.6 is been identified as a vulnerble which is used as a dependency for glob @7.1.6.

The description for the issue is been reported as follows,
In npm inflight there is a memory leak because some resources are not freed correctly after being used. It appears to affect all versions.

Please consider the attachment for the details.
image

@stale
Copy link

stale bot commented Sep 4, 2021

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@stale stale bot added the wontfix label Sep 4, 2021
@stale stale bot closed this as completed Sep 11, 2021
@daniloab daniloab reopened this Sep 12, 2021
@stale stale bot removed the wontfix label Sep 12, 2021
@daniloab daniloab added pinned Issues that will not be automatically closed wontfix labels Sep 12, 2021
@stale stale bot removed the wontfix label Sep 12, 2021
@jackbridger
Copy link

Have also had this flagged in a project. I believe that upgrading glob to > v9 should resolve the issue as they removed inflight isaacs/inflight-DEPRECATED-DO-NOT-USE#5

I can potentially help on this

@jaas666
Copy link

jaas666 commented Jun 20, 2024

Snyk is also picking this one up.
Any hopes of fixing?

@ahmedelq
Copy link

ahmedelq commented Jul 8, 2024

This issue has been hanging for 3 years now.
Will this get fixed any time soon?

Installing swagger gives:

npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.

and npm ls inflight gives:

└─┬ swagger-jsdoc@6.2.8
  └─┬ glob@7.1.6
    └── inflight@1.0.6

@jaas666
Copy link

jaas666 commented Jul 11, 2024

Created PR #400 to bump glob to v11.0.0
Hopefully it gets looked at.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
pinned Issues that will not be automatically closed
Projects
None yet
Development

No branches or pull requests

5 participants