Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update request dependency #62

Open
onury opened this issue Jul 22, 2019 · 2 comments · May be fixed by #64
Open

Update request dependency #62

onury opened this issue Jul 22, 2019 · 2 comments · May be fixed by #64

Comments

@onury
Copy link

onury commented Jul 22, 2019

NPM warnings when iyzipay is installed for a project:

npm WARN deprecated tough-cookie@2.2.2: ReDoS vulnerability parsing Set-Cookie https://nodesecurity.io/advisories/130
npm WARN deprecated node-uuid@1.4.8: Use uuid module instead
npm WARN deprecated boom@2.10.1: This version is no longer maintained. Please upgrade to the latest version.
npm WARN deprecated cryptiles@2.0.5: This version is no longer maintained. Please upgrade to the latest version.
npm WARN deprecated hoek@2.16.3: This version is no longer maintained. Please upgrade to the latest version.

Most of these issues below are addressed in latest version of request (as of July 2019).

@onury onury linked a pull request Jul 22, 2019 that will close this issue
@nb256
Copy link

nb256 commented Feb 10, 2020

2 high severity vulnerabilities exist on current dependencies and they can be seen on npm audit logs:

Regular Expression Denial of Service
tough-cookie
https://www.npmjs.com/advisories/525

Insufficient Entropy
cryptiles
https://www.npmjs.com/advisories/1464

@mertssmnoglu
Copy link

Request package is deprecated and have many vulnerabilities. iyzipay-node package is a payment library that should focus on the security. You should migrate to another web-http library/framework.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants