-
-
Notifications
You must be signed in to change notification settings - Fork 26.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Upgrade ESLint dependencies to fix "high severity security vulnerabilities" #8663
Comments
These answers cover only part of the problem, what about |
@ashylen AFAIK there is no automated security fix for |
npm i minimist |
Hi, npm i minimist doesn't take away my vulnerability... : ( Is there any other way to perform the manual review? Thank you |
I tried with
|
Yarn users should be able to work around this using by adding the following to package.json:
At least for my case this satisfied GitHub's automated security bot. |
With npm I tried |
If anyone finds a working fix, please create a pull request. |
A temporary solution. Adding:
in the package.json and running Of course, you will need to test your affected app(s) (there is a |
I also get the
|
The acorn issue appears to come from jest@24.9.0. It is nested down in jsdom, which appears have been upgraded as of jest@25.2.3 |
You need to locate where minimalist used and update the package.json inside node_modules folder, Then the error gone! The problem is there are some of my modules using minimalist! all node packages using another package and have their own package.json. I fixed the issue by:
then I see the result (for example yargs-parser package): I locate the path in CMD and update package.json for yargs-parser inside the node modules folder and update the patch of the module then inside the folder I run: |
Are there any updates? Is there an automated way to fix this yet with npm audit fix? |
There was never any real vulnerability here, but this appears solved regardless so I'm closing. |
Is your proposal related to a problem?
When creating a new app with the default template it starts with two high severity security vulnerabilities in two of ESLints dependencies: acorn and minimist.
The releases 1.8.3 and lower of svjsl (JSLib-npm) are vulnerable, but only if installed in a developer environment. A patch has been released (v1.8.4) which fixes these vulnerabilities.
Identifiers:
CVE-2020-7598
SNYK-JS-ACORN-559469
Describe the solution you'd like
Upgrade minimist to version 1.2.2 or later.
Upgrade acorn to version 7.1.1 or later.
Describe alternatives you've considered
N/A
Additional context
The text was updated successfully, but these errors were encountered: