Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updated request to avoid security vulnerability in dep #20

Closed
wants to merge 1 commit into from

Conversation

rankida
Copy link

@rankida rankida commented Jul 18, 2018

Hi,

Older versions of hoek have a security vulnerability https://snyk.io/vuln/npm:hoek:20180212 and this is pulled in by old versions of request.

This PR simply bumps request to to 2.87.0 (from 2.81.0) to avoid this issue.

Please let me know if I have done anything wrong with this PR.

Thanks!

@rankida rankida requested a review from a team as a code owner July 18, 2018 09:39
@zkat
Copy link
Contributor

zkat commented Jul 18, 2018

We are intentionally not upgrading request to 2.87.0 until node-gyp gets around to unpinning that package. We can't really do much about it being in our tree, and having the toplevel request be a different version than what node-gyp uses is significantly increasing the package size for our distributed tarball.

As far as we're concerned, the issues with hoek do not pose a risk to npm itself, which is why we decided to let the audit be a little noisy for now.

You wanna try and convince the node-gyp folks to fix that bit? :)

@zkat
Copy link
Contributor

zkat commented Jul 19, 2018

I'm gonna actually close this, and there's also a more thorough answer on the discussion board: https://npm.community/t/npm-i-npm-6-2-0-latest-shows-security-noise/709/3

tl;dr you're safe. Like, for sure.

@zkat zkat closed this Jul 19, 2018
@rankida
Copy link
Author

rankida commented Jul 19, 2018

Thanks for taking the time to reply.

Cheers!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants