Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

security vulnerability? due to old hawk@3.1.3 (and hoek@2.16.3) dependency

See original GitHub issue

in our project, snyk recently started complaining that we have a dependency with a known security vulnerability. It complains about hoek@2.16.3 which is required by hawk@3.1.3 which is required by the latest version of node-pre-gyp

the latest version of hoek (version 5.0.3) fixed the vulnerability. But node-pre-gyp has locked the version of hawk to 3.1.3 while the latest version of hawk is 7.0.7. Using such an old version of hawk also uses a very old version of hoek.

Would it be easy to upgrade to the latest version of hawk so we get the latest version of hoek without the vulnerability?

More info about the (low prio) vulnerability in hoek can be found at https://snyk.io/vuln/npm:hoek:20180212

Issue Analytics

State:
Created 6 years ago
Reactions:45
Comments:10 (2 by maintainers)

Top GitHub Comments

9reactions

pumanocommented, Feb 21, 2018

@springmeyer any news about dependency updates?

0reactions

springmeyercommented, Mar 10, 2018

Fixed by merging #347

Top Results From Across the Web

Fixing security vulnerabilities in npm dependencies in less ...

2.1) To fix any dependency, you need to first know which npm package depends on that. npm audit. This will tell you the...

Published Security Vulnerabilities for DB2 for Linux, UNIX ...

Security Bulletin: Multiple vulnerabilities in the Expat library affect IBM® Db2® Net Search Extender may lead to denial of service or arbitrary code...

Known Exploited Vulnerabilities Catalog | CISA

This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack...

github - Proper way to fix potential security vulnerability in a ...

We found a potential security vulnerability in one of your dependencies. A dependency defined in ./package-lock.json has known security ...

Apache Log4j Security Vulnerabilities

0 release, that could lead to information leaks, RCE (remote code execution) and LCE (local code execution) attacks. Base CVSS Score changed ......