Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Change download package for node-downloader-helper #565

Merged
merged 1 commit into from
Jan 16, 2023
Merged

fix: Change download package for node-downloader-helper #565

merged 1 commit into from
Jan 16, 2023

Conversation

gmeligio
Copy link
Contributor

This PR replaces the download package that has some vulnerabilities for the package node-downloader-helper.

A vulnerability with a high risk that download has:
GHSA-pfrx-2q88-qq97

I chose node-downloader-helper because is being maintained actively and the API is as simple as download's.

I ran npm run test and all the tests passed.

Closes #515

@davesnx
Copy link
Member

davesnx commented Jan 16, 2023

Hi @gmeligio, Thanks for the PR.

CI was failing on semantic-release step, fixed in #566.

If you rebase we should see the node-downloader-helper running in CI to ensure works for any node version

@gmeligio
Copy link
Contributor Author

Hi @davesnx . Thank you for reviewing and fixing the CI issue.

I rebased the branch. Can you approve the workflow run, please?

@davesnx davesnx merged commit a858164 into sanack:main Jan 16, 2023
@davesnx
Copy link
Member

davesnx commented Jan 16, 2023

🎉 This PR is included in version 2.3.5 🎉

The release is available on:

Your semantic-release bot 📦🚀

@gmeligio gmeligio deleted the got-CVE-2022-33987 branch January 16, 2023 21:36
@gmeligio
Copy link
Contributor Author

Thank you @davesnx !

@davesnx
Copy link
Member

davesnx commented Jan 16, 2023

Thanks to you @gmeligio

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Socket redirect vulnerability in "got" dependency
2 participants