Vulnerable version of node-notifier in dependency tree

I got a security notice for node-notifier in my project that uses tsdx@0.14.0 (see screenshot below)

This is the output of npm ls node-notifier:

➜ npm ls node-notifier

└─┬ tsdx@0.14.1
  └─┬ jest@25.5.4
    └─┬ @jest/core@25.5.4
      └─┬ @jest/reporters@25.5.1
        └── node-notifier@6.0.0

Looks like updating the version of jest to 26.0.0 would fix this issue

Screenshot

[agilgur5]

Thanks for reporting this, I see the same issue here. I’m not sure if the vulnerable code path actually affects us though.

Looks like updating the version of jest to 26.0.0 would fix this issue

Unfortunately that is easier said than done given that it would require a breaking change.

The patch in node-notifier is quite small, so I would think that would be simple to backport to v6 as well.

Jest 26 was also vulnerable until a backport was made for v8.

[zeusdeux]

Gotcha. Thanks @karlhorky! And appreciate the quick response! 🙏🏼