Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump dateformat version #273

Closed
wants to merge 1 commit into from

Conversation

stephenkubovic
Copy link

Fixes #271

This project is impacted by this CVE https://www.npmjs.com/advisories/1753/versions by the following dependency chain: dateformat@~1.0.4-1.2.3 -> meow@^3.3.0 -> trim-newlines@^1.0.0

The test suite for this project is not passing on my machine (both before or after this version bump). Using the latest dateformat version "manually" as it it's used in ts-node-dev does give the expected result though.

@pkuczynski
Copy link

Any chance to get this merged and release new version soon @wclr?

@jimmywarting
Copy link

jimmywarting commented Jun 10, 2021

Gona beg the question: Do you really need ~350 lines of code from the dateformat dependency?

...Just so you can use it on one single place that dose only log a date in a specific format in the terminal where only developer will see it:

if (cfg.timestamp) msg = color(fmt(cfg.timestamp), '30;1') + ' ' + msg

Alternative consideration:

new Date(timestamp).toLocaleString()

...sure it's not the same format but it will be localized to the format you are most comfortable with in your own country/language/machine

Or just use toJSON/toISOString and you would get a more precise detailed ISO standard string with a known timezone where date, month and year can't be confused for something else - and would be easy to parse if you need to parse a log file

@jimmywarting
Copy link

dateformat is gone... can close this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Upgrade dateformat to address vulnerability in transitive dependency trim-newlines
3 participants