Skip to content

[Snyk] Security upgrade node-pre-gyp from 0.6.39 to 0.17.0 #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fengmk2 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Security upgrade node-pre-gyp from 0.6.39 to 0.17.0 #14

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@
},
"dependencies": {
"nan": "~2.1.0",
"node-pre-gyp": "~0.6.14"
"node-pre-gyp": "~0.17.0"

@gemini-code-assist gemini-code-assist Bot Jul 15, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This is a major version upgrade for node-pre-gyp from ~0.6.14 to ~0.17.0. This is a significant jump that likely includes breaking changes, despite what the Snyk report might indicate.

The most critical issue is the required Node.js version.

  • node-pre-gyp@0.17.0 requires Node.js >= 10.
  • This project's dependencies (e.g., nan: "~2.1.0") and lack of an engines field in package.json suggest it is designed to support much older Node.js versions (e.g., Node v4).

Upgrading to node-pre-gyp@0.17.0 will likely break the installation process for users on Node.js versions older than 10.

Recommendation:

  1. Determine the minimum Node.js version this package needs to support.
  2. If support for older Node.js versions is required, this upgrade is not suitable. You may need to find an intermediate version of node-pre-gyp that patches the vulnerabilities while retaining compatibility.
  3. If you are dropping support for older Node.js versions, you should declare this as a breaking change (e.g., by bumping the major version of your package) and add an engines field to package.json to reflect the new requirement. For example: 
    "engines": {
  "node": ">=10"
}

},
"bundledDependencies": [
"node-pre-gyp"
Expand Down