-
Notifications
You must be signed in to change notification settings - Fork 113
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
npm audit - moderate vulnerabilities in deep json-schema dependency #434
Comments
Suggestion: remove npm dependency. I still believe that the plugin always invokes global Have a look: Line 23 in 708c29b
if we want execa to call the plugins's own npm version, we should pass preferlocal option.
|
We had this discussion before, I think more than once. I don't have the time to dig it out. It would be good if we could document the reasoning so that the same discussion doesn't pop up again |
from execa@2.0.0, I have some time to dig ) https://github.com/sindresorhus/execa/releases/tag/v2.0.0 |
They've gone from moderate to high. The following is after a fresh checkout of
|
Getting a handful of vulnerability warnings with this package when running
npm audit
on the latest version:With no clear way to fix this.
The text was updated successfully, but these errors were encountered: