Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Vulnerability in eslint > espree > acorn

See original GitHub issue

NPM audit is reporting a vulnerability in eslint accorn dependency. Patch is available, but eslint need to be updated.

Issue Analytics

State:
Created 4 years ago
Comments:6 (2 by maintainers)

Top GitHub Comments

1reaction

arijnrcommented, Mar 10, 2020

This repository has a “^” before the eslint dependency declaration. It means all non breaking changes in eslint can be downloaded if new eslint versions become available.

The vulnerability has been fixed in eslint and a new version with no breaking change has been released. But maybe the older versions are forced in your packge-lock.json.

You could try as below: -> remove node_modules (maybe not needed) -> remove “rewire” from package.json -> npm install (“rewire” should disappear from package-lock.json) -> add “rewire” again to your package.json -> npm install (rewire will appear again in package-lock.json, but with new dependencies versions for rewire)

1reaction

rensbaardmancommented, Mar 9, 2020

Unfortunately, this repo hasn’t been updated in quite a while. I maintain a fork that has the eslint updates already. Should be a drop-in replacement.