High severity vulnerabilities in dependencies #340

Activity

1. pranavj1001 commented on Jun 29, 2022

   

   pranavj1001

   on Jun 29, 2022

   Member

   More actions

   Hey @m-hauck, can you please try upgrading to v1.16.0. We have bumped up the version and on running npm audit, we can see no high or critical vulnerabilities now.
2. m-hauck commented on Jun 30, 2022

   

   m-hauck

   on Jun 30, 2022

   Author

   More actions

   Hi @pranavj1001, thanks for the update. This fixes the four high severity vulnerabilities for me. Now I only got five moderate severity vulnerabilities left.

   # npm audit report
   
   got  <11.8.5
   Severity: moderate
   Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97
   fix available via `npm audit fix --force`
   Will install browserstack-cypress-cli@1.10.1, which is a breaking change
   node_modules/got
     package-json  <=6.5.0
     Depends on vulnerable versions of got
     node_modules/package-json
       latest-version  0.2.0 - 5.1.0
       Depends on vulnerable versions of package-json
       node_modules/latest-version
         update-notifier  0.2.0 - 5.1.0
         Depends on vulnerable versions of latest-version
         node_modules/update-notifier
           browserstack-cypress-cli  >=1.11.0
           Depends on vulnerable versions of update-notifier
           node_modules/browserstack-cypress-cli
   
   5 moderate severity vulnerabilities
   
   To address all issues (including breaking changes), run:
     npm audit fix --force
   

   Is there any plan on fixing those as well?
3. pranavj1001 commented on Jul 12, 2022

   

   pranavj1001

   on Jul 12, 2022

   Member

   More actions

   Hey @m-hauck, we don't have plans for fixing this in the near future. Updating update-notifier library is introducing some breaking changes for browserstack-cypress-cli. We'll revisit this. Till then, I'm keeping this issue open.