Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Fix: npm pkgs vulnerabilities

See original GitHub issue

Issue or Feature Request Description: What’s the update to fix high and critical pkgs vulnerabilities?

found 44 vulnerabilities (4 low, 6 moderate, 32 high, 2 critical) in 61143 scanned packages
  run `npm audit fix` to fix 18 of them.
  16 vulnerabilities require semver-major dependency updates.
  10 vulnerabilities require manual review. See the full report for details.

Thank you 🙏

Issue Analytics

State:
Created 4 years ago
Comments:8 (5 by maintainers)

Top GitHub Comments

1reaction

jeffposnickcommented, Aug 13, 2020

Yes, but in Workbox v6, which raises the minimum required version of Node to v10.

We did a broad dependency version bump for Workbox v6.0.0-alpha.1, which is available for testing now. We’ll do another bump prior to the next alpha release.

Resolving all these issues while still maintaining compatibility with Node v8, which is what Workbox v5 supports, has proven infeasible in the past.

1reaction

jeffposnickcommented, Apr 30, 2020

#2480 and #2481 should hopefully take care of things for v6.

Those PRs address dependencies used by workbox-build, workbox-cli, and workbox-webpack-plugin.