Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Old request dependency with old depencies wich have vulnerabilities #3169

Closed
Kartoffelsalat opened this issue Feb 16, 2018 · 7 comments
Closed

Old request dependency with old depencies wich have vulnerabilities #3169

Kartoffelsalat opened this issue Feb 16, 2018 · 7 comments

Comments

@Kartoffelsalat
Copy link

The Less Npm Module uses request in version 2.81.0 wich is using an old hawk module, wich is using hoek versoin 2.16.3 wich has the following nodesecurity vulnerability.

Updating request to 2.83.0 should solve this.
@Kartoffelsalat Kartoffelsalat changed the title Old Request dependency with old depencies wich have vulnerabilities Old request dependency with old depencies wich have vulnerabilities Feb 16, 2018
@matthew-dean
Copy link
Member

Can you make a PR?

@Kartoffelsalat
Copy link
Author

Kartoffelsalat commented Feb 19, 2018 •
edited
Loading

Sure i will try to :)
@matthew-dean Just one question how should i do it? I cant create branches in this project.

@seven-phases-max
Copy link
Member

seven-phases-max commented Feb 19, 2018 •
edited
Loading

https://help.github.com/articles/creating-a-pull-request/

Well, in the simplest case GitHub will automatically fork things for you when you edit and save the file(s) of interest right via web-interface.

Kartoffelsalat pushed a commit to Kartoffelsalat/less.js that referenced this issue Feb 21, 2018
chore(package): update request to 2.83.0
bd2a93f 
The old request package has some vulnerable dependencies inside. So because nsp detected it has to be updated, see: https://nodesecurity.io/advisories/566

less#3169
@Kartoffelsalat Kartoffelsalat mentioned this issue Feb 21, 2018
Merged
@Kartoffelsalat
Copy link
Author

Not sure if it was correct to update the versions last digit, if not change it back.

@Kartoffelsalat
Copy link
Author

Can you state a date when there will be a new Tag with this update available?

@seven-phases-max
Copy link
Member

No idea, sorry (e.g. see less/less-meta#26).

@seven-phases-max
Copy link
Member

Closing as done in #3177.

@hughns hughns mentioned this issue Apr 18, 2018
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@matthew-dean @Kartoffelsalat @seven-phases-max