Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.
And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.
Publish New NPM version for Node-Static
See original GitHub issueHey 👋 I notice its been a while since a new version of node-static has been pushed to NPM, and the version that currently exists there contains the package minimist which has a (github advisory) for it. This package was being used which is used by a package in this project called optimist. In this pull request, @brettz9 removed optimist to resolve this vulnerability. As a result, publishing a new version of node-static will ensure that all users of this package will use a safe version by default.
cc @cloudhead
Issue Analytics
- State:
- Created 2 years ago
- Reactions:17
- Comments:12 (1 by maintainers)
Top Results From Across the Web
Top Related Medium Post
Top Related StackOverflow Question
Troubleshoot Live Code
Top Related Reddit Thread
Top Related Hackernoon Post
Top Related Tweet
Top Related Dev.to Post
Top Related Hashnode Post
If you look at https://www.npmjs.com/package/node-static , it was last published 4 years ago, and the latest version is 0.7.11.
If you use the “blame” feature for the file defining the version, you can see a commit from 12 months ago where it was changed from
vartoconst(but still listing 0.7.9) at the time.Thus, the version just hadn’t been updated despite subsequent releases up to 0.7.11
As to why there is a
const, etc., there have been (many) changes onmastersince that time and we are awaiting a new publishing. The project owner still needs to give final approval on these changes, so these many changes have not been published to npm yet.FWIW, some of the changes are available on my fork,
@brettz9/node-static(using a different (smaller) versioning number as it is an independent project), but as the author of the regularnode-statichere eventually replied granting access to the project with openness to including my changes, I resumed work here.Thank you @brettz9 we look forward for a new version to be released so that we can easily integrate the fix.