npm audit reports nested dependency decompress as vulnerable

[jbauerrfid]

The npm audit output is:

  High            Arbitrary File Write
  Package         decompress
  Patched in      No patch available
  Dependency of   @shelf/jest-mongodb [dev]
  Path            @shelf/jest-mongodb > mongodb-memory-server >
                  mongodb-memory-server-core > decompress
  More info       https://npmjs.com/advisories/1217

found with @shelf/jest-mongodb: version 1.1.3

[vladholubiev]

Hey Jan, thanks for bringing this up!

Please raise this issue in the downstream dependency as well https://github.com/nodkz/mongodb-memory-server/issues

I'll update the lib once it's fixed there asap

[jenoosia]

mongodb-memory-server v6.4.1 includes the fix. Relevant issue: typegoose/mongodb-memory-server#271

[kvnsw]

Looks like issue is solved with the latest commit, any chances we can get a new release soon? @vladgolubev :)

[vladholubiev]

v1.1.4 is out

It includes the latest versions of all npm dependencies