Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Update `package-json` to >=8.0.0 for vulnerability in `got` >= 12.0.0, < 12.1.0, < 11.8.5

See original GitHub issue

Environment

nodemon -v: 2.0.15
node -v: v14.18.1
Operating system/terminal environment: macOS 12.5

Issue

nodemon@2.0.15 requires got@^9.6.0 via a transitive dependency on package-json@6.5.0

Vulnerabilty: The got package before 12.1.0 for Node.js allows a redirect to a UNIX socket.
Affected Versions: >= 12.0.0, < 12.1.0, < 11.8.5
Patched versions: 12.1.0, 11.8.5
References

Possible fix

Upgrade dependency version of package-json to >=8.0.0 as it points to fixed dependency for got >12.1.0

Issue Analytics

State:
Created a year ago
Reactions:2
Comments:10 (7 by maintainers)

Top GitHub Comments

2reactions

kevinswarnercommented, Jun 23, 2022

I am not sure this was resolved. When I install the latest nodemon, and then run an audit, I get the following results…


┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Got allows a redirect to a UNIX socket                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ got                                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=11.8.5                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ nodemon [dev]                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ nodemon > update-notifier > latest-version > package-json >  │
│               │ got                                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://github.com/advisories/GHSA-pfrx-2q88-qq97            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 moderate severity vulnerability in 1474 scanned packages
  1 vulnerability requires manual review. See the full report for details.

Perhaps I did not update nodemon correctly?

Thanks!

1reaction

gaborszitacommented, Jun 23, 2022

By reading issue https://github.com/remy/nodemon/issues/2031 we can see that due to issues with update-notifier the project owner plans to drop this dependency entirely in the next release. So, hopefully, this will get fixed in the next release. Until then, I recommend using v2.0.17 if it doesn’t break your install, and otherwise use v2.0.18 or v2.0.16.

Top Results From Across the Web

Fixing security vulnerabilities in npm dependencies in less ...

This is the first thing you should do and it's the simplest one too. Run npm update — https://docs.npmjs.com/cli-commands/update.html; Delete your package-lock.

Got allows a redirect to a UNIX socket - Stack Overflow

I already tried npm audit fix --force but it gives me more vulnerabilities due to the older version of react-scripts. My question is...

Denial Of Service (DoS) Vulnerability in the node library (+1 ...

A direct dependency is a library that is specified in your project's package.json. A vulnerability in a direct dependency can be fixed by...

permissions - CVE - Search Results

An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be...

CHANGELOG.md · master · GitLab.org / omnibus-gitlab

No changes. 15.4.4 (2022-11-02). Security (2 changes). Upgrade pcre2 to 10.40 (merge request) ...