Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Please update concurrently to 5.0.1 #185

Closed
eternalmatt opened this issue Dec 10, 2019 · 2 comments
Closed

Please update concurrently to 5.0.1 #185

eternalmatt opened this issue Dec 10, 2019 · 2 comments

Comments

@eternalmatt
Copy link
Contributor

eternalmatt commented Dec 10, 2019

I'm submitting a...


[ ] Regression 
[x] Bug report
[ ] Feature request
[ ] Documentation issue or request

Current behavior

There is a transitive prod dependency in this package that is seen as a security vulnerability by some tools. Please update to concurrently@5.0.1 to resolve. I have a PR for this.

Prior art: https://github.com/kimmobrunfeldt/concurrently/issues/204

Before updating (on master):

>npm ls execa --prod
@nestjs/ng-universal@2.0.1
`-- concurrently@5.0.0
  `-- yargs@12.0.5
    `-- os-locale@3.1.0
      `-- execa@1.0.0  <-- this is the offending package

Expected behavior

>npm ls execa --prod
@nestjs/ng-universal@2.0.2
`-- (empty)

Minimal reproduction of the problem with instructions

npm ls execa --prod

What is the motivation / use case for changing the behavior?

I work in an enterprise which uses SonarQube. This tool has found execa to be security vulnerability when in included in prod dependencies. concurrently is typically meant to be used as a devDependency so if this were the case, my tool would not have a problem here.

Through some light digging and reading the output of npm ls, I found that os-locale (and therefore execa) was removed in a later version of yargs. I submitted the PR to concurrently to use later yargs.

Environment

Any


Nest version: 2.0.1
 
For Tooling issues:
- Node version: 12.13.1 
- Platform:  Windows 
- npm 6.12.1
@eternalmatt
Copy link
Contributor Author

Oh hey it looks like there is already a PR for this in #184

@kamilmysliwiec
Copy link
Member

Tracked here #184

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants