Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Use of a vulnerable dependency

See original GitHub issue

Snyk recently pointed out in some of my projects that some dependencies were vulnerable to an issue that goes back to extend and sshpk but those were apparently fixed in the request@2.88.0 which has been updated on jsdom (currently at v13.1.0). This package, however, doesn’t use an up-to-date and vulnerability free version of jsdom and PRs like #1230 are still hanging. Would it be possible to get this sorted (I was planning on opening a PR myself but @greenkeeper already did)?

Issue Analytics

State:
Created 5 years ago
Comments:5 (1 by maintainers)

Top GitHub Comments

1reaction

robogeekcommented, Jan 26, 2019

I’m curious if the Cheerio project is still alive. The last commit to the README claims that ongoing development is happening in the main branch, and gives a link for the branch for the last release – however that commit was a few months ago and of course there’s been no activity since.

I find this worrying since I’ve built a fairly large application (https://akashacms.com) around Cheerio.

0reactions

fb55commented, Jan 30, 2019

Activity has definitely slowed down right now. I still want to get a final 1.0 out at some point, but it is not a priority right now.

This issue does not seem to be a pressing, as jsdom is only a dev dependency that’s used for benchmarking. Happy to accept PRs!

Top Results From Across the Web

What are Vulnerable Dependencies?

When a security vulnerability is found in a third-party dependency, and a new version with a fix is released, it is the responsibility...

Vulnerabilities in Dependencies: What You Need to Know

Here's what you need to know about the vulnerabilities in dependencies, third party components and open source.

Vulnerable Dependency Management Cheat Sheet

The vulnerable dependency is found during one of the following situation in which the provider is not aware of the vulnerability: Via the...

Remediating vulnerable dependencies

In operating a system with a dependency scan you'll find that vulnerabilities do pop up in your dependencies, and this is a guide...

Securing Your Dependencies - Hacksplaining

Increasingly, dependencies are a vector for “supply-chain attacks”, where an attacker injects malicious code into third-party software. Researchers have ...