Vulnerability with acorn

[vishnutsivan]

🐞 Bug report

Our security check tool is throwing a vulnerability issue with acorn 6.3.0

Description

@angular-devkit/build-angular@0.901.7 is dependent on less version 3.11.1 which has dependency with acorn@6.3.0.

Possible Fix

We think we can solve this issue by updating less to version 3.11.3

Please have a look on pull request #17898

[alan-agius4]

Hi @vishnutsivan, can you please share the vulnerability report? less 3.11.1 doesn't depend on acorn.

https://unpkg.com/browse/less@3.11.1/package.json

[vishnutsivan]

@alan-agius4 in package.json of less 3.11.1 there is no dependency on acorn. But if we browse node_modules then we can find it's reference

[alan-agius4]

@vishnutsivan I see, the used to ship a node_modules directory as part of the package.

[vishnutsivan]

@alan-agius4 yes, and in the latest version of less ie 3.11.3 there are no such shipping of node_modules

[alan-agius4]

Note: this security notuice doesn't effect package manager audit tools such as NPM and Yarn.

@vishnutsivan, left you a couple of comments on the PR, thanks.