Update make-dir to resolve vulnerable dependency #3806
Description
the less.js dependency make-dir is not up-to-date and causes security warning due to its outdated dependency.
see GHSA-c2qf-rxjj-qqgw
$ npm ls semver
less@4.1.3 project
└─┬ make-dir@2.1.0
└── semver@5.7.1
I would suggest updating to a current make-dir version here.
A quick search showed that it is only used here, so from my point of view an update should bring little problems.
less.js/packages/less/bin/lessc
Lines 163 to 172 in 7491578
Metadata
Metadata
Assignees
Type
Projects
Milestone
Relationships
Participants
Activity
stefandobre commentedon Jul 6, 2023
It appears an outdated version of semver is also referenced as a dev dependency here:
less.js/packages/less/package.json
Line 100 in 4d3189c
stefandobre commentedon Aug 1, 2023
@iChenLei, is there any update on this? If not, would a pull request be welcome?
Den-dp commentedon Aug 2, 2023
it was fixed on
make-dirside, runnpm audit fixor try to reinstalllessjorenbroekema commentedon Dec 7, 2023
That will only fix it if you use
--forcebecause the vulnerability fix has not been done in v2 of make-dir, but rather in the next major(s).This means it would be best if
lesscan upgrademake-dirto the latest major version.Dunno if this repo is still maintained but I'd be open to creating a pull request.
iChenLei commentedon Dec 7, 2023
@jorenbroekema PR welcome
jorenbroekema commentedon Dec 7, 2023
@iChenLei done #4250