update package: update-notifier, fixes package vulnerability #387
Conversation
| @@ -262,15 +310,13 @@ | |||
| "version": "1.1.0", | |||
| "resolved": "https://registry.npmjs.org/arr-flatten/-/arr-flatten-1.1.0.tgz", | |||
| "integrity": "sha512-L3hKV5R/p5o81R7O02IGnwpDmkp6E982XhtbuwSe3O4qOtMMMtodicASA1Cny2U+aCXcNpml+m4dPsvsJ3jatg==", | |||
| "dev": true, | |||
| "optional": true | |||
There was a problem hiding this comment.
Why were all of the optional fields removed? Which version of NPM did you run your install/update from?
| @@ -89,7 +89,7 @@ | |||
| "semver-diff": "^2.0.0", | |||
| "text-table": "^0.2.0", | |||
| "throat": "^2.0.2", | |||
| "update-notifier": "^2.1.0", | |||
There was a problem hiding this comment.
It looks like CI passed, but with this upgrading 2 major versions, there is some risk. Did you evaluate what changed in update-notifier between 2.1 and 4.1? No breaking changes that affect npm-check?
There was a problem hiding this comment.
not really familiar with the project, just need the vulnerability gone
There was a problem hiding this comment.
Just thought I'd chime in here (I'm not the submitter). I had a look at the release notes for the update-notifier package and, from my checking, I only see one breaking change of note: in v3.0.0 of update-notifier, support for node v6 was dropped, and they currently only support node v8 onwards. Maybe npm-check's Travis CI file needs to be updated to remove node versions 4 and 6 from it?
The other breaking changes are in v4.0.0 of update-notifier, but from my source code searches they do not affect npm-check:
- "Remove the callback option".
callbackis a field in the options object that can be passed toupdateNotifier. npm-check only uses thepkgoption. - "Rename the boxenOpts option to boxenOptions". This is one of the options you can optionally pass to notifier.notify([options]). npm-check does not use any options with that
notifycall. - "Update boxen dependency". The release notes say that this may affect the
boxenOptionsvalues. npm-check does not useboxenOpts/boxenOptions. - "Disable update notifications when NODE_ENV is test". This affects testing scenarios only so should have no impact on npm-check usage.
There was a problem hiding this comment.
@Splaktar -- just bumping this thread. Thanks!
|
Merged with #397 |
Vulnerability:
High Prototype Pollution
Package dot-prop
Patched in >=5.1.1
update-notifier > configstore > dot-prop