You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
Current versions of the react-reactive-form package depend on opencollective@1.0.3
This package is end-of-life -- will not see further updates, yet transitively depends on versions of the the minimist package that are vulnerable to two cases of prototype pollution. By extension this leaves consumers of the react-reactive-form package with a vulnerable version of minimist in their tree.
To Reproduce
Install the react-reactive-form package.
Run npm audit.
Expected behavior
No security vulnerabilities in the package tree by removing the dependency on opencollective.
(Note also that OpenCollective itself actively discourages continued use of their old solutions that hang off of postinstall scripts. They encourage using the built-in npm fund functionality instead.)
The text was updated successfully, but these errors were encountered:
rjgotten
changed the title
opencollective package is end-of-life and transitively depends on vulnerable versions of minimist
opencollective dependency is end-of-life and transitively depends on vulnerable versions of minimist
Jul 24, 2023
Describe the bug
Current versions of the
react-reactive-form
package depend onopencollective@1.0.3
This package is end-of-life -- will not see further updates, yet transitively depends on versions of the the minimist package that are vulnerable to two cases of prototype pollution. By extension this leaves consumers of the
react-reactive-form
package with a vulnerable version of minimist in their tree.To Reproduce
react-reactive-form
package.npm audit
.Expected behavior
No security vulnerabilities in the package tree by removing the dependency on opencollective.
(Note also that OpenCollective itself actively discourages continued use of their old solutions that hang off of postinstall scripts. They encourage using the built-in
npm fund
functionality instead.)The text was updated successfully, but these errors were encountered: