Current version of the levelup dependency for this project has a known security vulnerability

[jgw96]

A user opened an issue on our repo about the semver package having a security vulnerability ionic-team/stencil#568. After researching it we found that this was coming from a very old version of the levelup package that browserify-fs relies on.

[brettz9]

Is this something you expect you might have an ETA for a fix for or is the project abandoned?

[calvinmetcalf]

so the actual issue is about updating levelup to version 2.0.0, a pull request doing so and making sure the tests pass would go a long way to helping this be resolved

[calvinmetcalf]

actually I take it back, updating it to 0.19.1 would probably do the trick

[oBusk]

Updating levelup@0.19.1 will fix CVE-2015-8855 (patched in semver@>=4.3.2) but not Memory exposure in bl (patched in bl@>=0.9.5 <1.0.0 || >=1.0.1).

levelup@>=1.0.0 Is without any issues.

[microshine]

I've got the same security notification

└─┬ rollup-plugin-node-builtins@2.1.2
  └─┬ browserify-fs@1.0.0
    └─┬ levelup@0.18.6
      └── semver@2.3.2

[awmottaz]

Any progress on this?

[mroderick]

Ping @mafintosh: will you consider the #15 PR, so we can get the ball rolling on fixing the security warnings in people's repositories?

[mafintosh]

Ya sure. Anyone here wanna help maintain this?

…

On Sun, 18 Nov 2018 at 04.32, Morgan Roderick ***@***.***> wrote: Ping @mafintosh <https://github.com/mafintosh>: will you consider the #15 <#15> PR, so we can get the ball rolling on fixing the security warnings in people's repositories? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#13 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAW_VXq2U0q-33wIddt7AGLNAmwry9Phks5uwGQ7gaJpZM4SRIy5> .

[brettz9]

If it's just a question of pulling for this update and possibly any future such ones (at least clear-cut ones like this), I could sign on (brettz9 on npm as well).

[brettz9]

Another issue that someone can hopefully address is that the current version of the dependency level-filesystem (1.2.0) has an outdated dependency chain of level-sublevel (5.2.3) -> xtend (2.0.6) -> object-keys (version 0.2.0, a deprecated version); see mafintosh/level-filesystem#9

[jdalrymple]

Any updates with this?

[vladimyr]

Ping @mafintosh: will you consider the #15 PR, so we can get the ball rolling on fixing the security warnings in people's repositories?

@mroderick I just made another PR (#24) with main differences being compared to #15 are that it is ready and it does not require browser testing/karma instead it uses spec compliant fake-indexeddb mock inside node/jest environment. I did not upgrade any dependencies but it can still be used as solid base for future security fixes.

/cc @mafintosh