moderate advisory in dependency

[newhouse]

I am on nodemon v2.0.16 and yarn audit tells me that there's a vuln in one of the dependencies:

GHSA-pfrx-2q88-qq97

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate      │ Got allows a redirect to a UNIX socket                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ got                                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=11.8.5                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ nodemon                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ nodemon > update-notifier > latest-version > package-json >  │
│               │ got                                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1075647                     │
└───────────────┴──────────────────────────────────────────────────────────────┘

I have no clue if update-notifiier and the rest of the tree-on-down have updated to fix this...but when they do it'd be great if you could update this!

Thanks for the great library!

[danepowell]

Here's the problem: yeoman/update-notifier#218

update-notifier needs to update its dependency on latest-version in order to fix this, but it seems somewhat unlikely to happen given the lack of development (last commit over a year ago) and lack of response to similar issues (yeoman/update-notifier#216, yeoman/update-notifier#214)

Seems like the real solution here is to replace update-notifier: #1961

[gaborszita]

This should've been fixed by v6.0.0 of update-notifier (released about 40 minutes ago), so please update nodemon's update-notifier dependency to v6.0.0.
yeoman/update-notifier#218
yeoman/update-notifier@9183541
https://github.com/yeoman/update-notifier/releases/tag/v6.0.0

[gaborszita]

I created a pull request for this, it should fix it.
#2029

[remy]

releasing now.

[lorand-horvath]

Just wanted to mention a directly related issue I opened regarding the vulnerability in the got package sindresorhus/got#2067

Thanks @gaborszita and @remy !
Ouch, I see you had to revert 1b3bc8c
Is there another solution?

[remy]

Had to revert as it borked installs. The next release, I hope, will remove update-notifier as it keeps bringing in issues.

[francisdb]

@remy is there an open related issue/pr we can track?

[gaborszita]

@remy is there an open related issue/pr we can track?

This project plans to drop update-notifier and there is an open issue for it #1961. I think updates will go there.