Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vulnerability with dependencies #36

Open
JuanIrache opened this issue Aug 1, 2018 · 1 comment
Open

Vulnerability with dependencies #36

JuanIrache opened this issue Aug 1, 2018 · 1 comment

Comments

@JuanIrache
Copy link

JuanIrache commented Aug 1, 2018

I'm getting these problems when suing the module. Not sure if it can be fixed by just updating to the latest modules or that would break something.

Manual Review
Some vulnerabilities require your attention to resolve

      Visit https://go.npm.me/audit-guide for additional guidance

High Regular Expression Denial of Service

Package minimatch

Patched in >=3.0.2

Dependency of tokml

Path tokml > strxml > tap > glob > minimatch

More info https://nodesecurity.io/advisories/118

Low Incorrect Handling of Non-Boolean Comparisons During
Minification

Package uglify-js

Patched in >= 2.4.24

Dependency of tokml

Path tokml > strxml > tap > runforcover > bunker > burrito >
uglify-js

More info https://nodesecurity.io/advisories/39

Low Regular Expression Denial of Service

Package uglify-js

Patched in >=2.6.0

Dependency of tokml

Path tokml > strxml > tap > runforcover > bunker > burrito >
uglify-js

More info https://nodesecurity.io/advisories/48

found 3 vulnerabilities (2 low, 1 high) in 3335 scanned packages
3 vulnerabilities require manual review. See the full report for details

@JuanIrache
Copy link
Author

I just realised there's work being done here: #31

johnlettman added a commit to johnlettman/overpassql-run that referenced this issue Aug 4, 2023
Switch tokml dependency to @maphubs/tokml

See: mapbox/tokml#36
See: mapbox/tokml#37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant