Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

1 vulnerability requires manual review.

See original GitHub issue

After installing forever, I get a notice from NPM about forever using dependencies with known vulnerabilities:

$ npm audit
                                                                                
                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ braces                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.3.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ forever [dev]                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ forever > forever-monitor > chokidar > anymatch > micromatch │
│               │ > braces                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/786                             │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 low severity vulnerability in 2776 scanned packages
  1 vulnerability requires manual review. See the full report for details.

Issue Analytics

State:
Created 4 years ago
Reactions:15
Comments:16 (7 by maintainers)

Top GitHub Comments

2reactions

kibertoadcommented, Jun 11, 2019

@indexzero Pretty please?.. It’s been fixed on forever-monitor for quite some time already. Could you please either publish it or give me publish permissions?..

1reaction

kibertoadcommented, Jan 5, 2020

Fixed in 2.0.0

Top Results From Across the Web

How to fix npm vulnerabilities manually? - Stack Overflow

Do a sanity check; In case it's a real problem, check the repository of vulnerable package for existing issues and PRs; In case...

Auditing package dependencies for security vulnerabilities

Security vulnerabilities found requiring manual review. If security vulnerabilities are found, but no patches are available, the audit report will provide ...

1 vulnerability required manual review and could not be updated

This vulnerability only affects babel-cli --watch '. Since babel-cli --watch is only used during developmenet/deployment, and the only way an ...

How to Fix Security Vulnerabilities with NPM - IFS Blog

Try running npm update command. · If you have a vulnerability that requires manual review, you will have to raise a request to...

Resolve NPM security vulnerabilities - Payam Mousavi - Medium

N vulnerabilities required manual review and could not be updated. You have some options here! One option is to ignore that specific vulnerability...