Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

High vulnerability package need to be updated [dot-prop]

See original GitHub issue

Screen Shot 2020-07-30 at 2 11 00 pm

Package update request.

the dot-prop package has been found vulnerable and needed to be updated.

[REQUIRED] Environment info

8.6.0

firebase-tools:

macOS

Platform:

[REQUIRED] Test case

npm audit

[REQUIRED] Steps to reproduce

npm audit

[REQUIRED] Expected behavior

no vulnerability

[REQUIRED] Actual behavior

found 2 high severity vulnerabilities in 1370 scanned packages

Issue Analytics

State:
Created 3 years ago
Comments:5 (4 by maintainers)

Top GitHub Comments

4reactions

samtsterncommented, Jul 30, 2020

@WuHarry we’ve done all we can do here, @bkendall is working on an update to superstatic which will fix the transitive dep.

0reactions

YahangWucommented, May 21, 2021

Opps, seems that I missed all the messages. Thanks and well done team!

Top Results From Across the Web

Facing vulnerability security issue for dot-prop when updating ...

After updating npm to the latest, I ran npm audit and got two vulnerabilities for the dot-prop package dependency which is showing under...

Prototype Pollution in dot-prop | CVE-2020-8116 | Snyk

Affected versions of this package are vulnerable to Prototype Pollution. It is possible for a user to modify the prototype of a base...

CVE-2020-8116 Detail - NVD

CVE-2020-8116 Detail. Current Description. Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x ...

Resolve NPM security vulnerabilities | by Payam Mousavi

It says, the dot-prop package has a security issue which needs to get ... N vulnerabilities required manual review and could not be...

Auditing package dependencies for security vulnerabilities

npm audit requires packages to have package.json and package-lock.json files. ... If security vulnerabilities are found and updates are available, ...