-
-
Notifications
You must be signed in to change notification settings - Fork 360
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
npm audit security vulnerability in semver <= 7.5.2 #2163
Comments
Is there any reason that can't be bumped? If not that would definitely be great to do. |
It would require to switch |
We cannot use ESM here until we only support the new ESLint flat config. |
As with 99% of all audit warnings, this one too does not apply to most projects, including this one: https://overreacted.io/npm-audit-broken-by-design/ There are ways to ignore audit warnings: https://stackoverflow.com/questions/72713764/how-to-ignore-a-package-during-npm-audit And hopefully even better ways in the future: npm/rfcs#18 |
I believe this specific issue no longer applies, as semver v5.7.2 was released with a backport of the fix for the security vulnerability (changelog, pull request). As a result, |
|
npm audit gives warning about the indirect
semver
dependency:semver
<--normalize-package-data
<--read-pkg
<--read-pkg-up
Updating to latest version of
read-pkg-up
should mitigate this.The text was updated successfully, but these errors were encountered: