yet another high severity vulnerability in the nested deps

[a-x-]

ava -> update-notifier -> ... -> deep-extend

CVE

Update please the update-notifier

[novemberborn]

Presumably however deep this dependency is installed, given that the fix is in a patch release it will be pulled in when you re-install your dependencies. But also, given that this is not a direct dependency of AVA, and not even a direct dependency of update-notifier, there is nothing we can do about this here. And finally, given that both AVA and update-notifier run during development rather than in your server, the kind of vulnerability described here simply will not affect you.

Assessing vulnerability reports is not easy, but there's no need to open these kinds of issues.

[a-x-]

you can pin specific version into package-lock.json

the kind of vulnerability described here simply will not affect you

yes, I know it, i disabled this report

but there's no need to open these kinds of issues

hm, okaaaay...