Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

npm audit security issue: probot > hbs > handlebars

See original GitHub issue

Bug Report

I imagine y’all have seen this already, but in case not (and also for a central place to discuss?).

Current Behavior npm audit shows:

                       === npm audit security report ===

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ handlebars                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.0.13                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ probot                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ probot > hbs > handlebars                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/755                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

Expected behavior/code npm audit should not reveal any security issues for probot.

Environment

Probot version(s): 8.0.0-octokit-16-preview.7
Node/npm version: node 10 / npm 6

Issue Analytics

State:
Created 5 years ago
Comments:6 (6 by maintainers)

Top GitHub Comments

1reaction

karol-majewskicommented, Mar 4, 2019

Fixed in #875.

1reaction

gr2mcommented, Feb 18, 2019

Looks like we need to look for an alternative, thanks for bringing this to our attention Chris!

Top Results From Across the Web

JavaScript - How to fix Handlebars Security Vulnerability

Adding one of these lines to the package.json file does not appear to resolve the security issue. Rather, the only instance I have...

Untitled

Item not received paid with paypal, Candaba wetlands, Mana tv schedule october 2012, Dean juliano, Annings cider tesco, Roadrunner internet issues, ...

2.xml - jsDelivr

https://www.jsdelivr.com/package/npm/@automattic/lasagna monthly https://www.jsdelivr.com/package/npm/@automattic/load-script monthly ...

Click here to download - Computer Science

... own found sports house related security both g county american photo game ... texas oct pay four poker status browse issue range...

wordlist_no_underscores.txt - Index of /

... mik atgdevopsbuilder ejb-security-interceptors coveragerow edituser ... systamp github-issue dwpmplayer scorekeeperlistitem 37x-checkmark nametag ...