Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade node-notifier package to > version 8.0.1 in package-lock.json #565

Closed
palisadoes opened this issue Mar 30, 2021 · 5 comments
Closed
Assignees
Labels
bug Something isn't working

Comments

@palisadoes
Copy link
Contributor

We need to remedy the following known vulnerability: GHSA-5fw9-fq32-wv5p

GitHub cannot automatically do the required update to > 8.0.1 because:

The latest possible version that can be installed is 7.0.2 because of the following conflicting dependency:

jest@26.0.1 requires node-notifier@^7.0.0 via a transitive dependency on @jest/reporters@26.0.1
The earliest fixed version is 8.0.1.

This update needs to be implemented and tested.

@palisadoes palisadoes added the bug Something isn't working label Mar 30, 2021
@github-actions github-actions bot added the unapproved Unapproved, needs to be triaged label Mar 30, 2021
@palisadoes
Copy link
Contributor Author

Assigned to @Hrishikesh-Bhagwat

@palisadoes palisadoes removed the unapproved Unapproved, needs to be triaged label Mar 30, 2021
@yasharth291
Copy link
Contributor

if this work is not complete @palisadoes can I work on it @Sagar2366

@Hrishikesh-Bhagwat
Copy link
Contributor

I am working on it.I know it was not complete facebook has not made a change in their official package yet. I had mentioned that to the mentors. As soon as it is done I will fix it.

@yasharth291
Copy link
Contributor

okay i understood you can carry on

@Hrishikesh-Bhagwat
Copy link
Contributor

Yeah but the strange part is npm does not show vulnerabilities in that package.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

3 participants