Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

vulnerability CVE-2020-15168 is introduced by package node-fetch #53

Open
ayaka-kms opened this issue Aug 9, 2021 · 1 comment
Open

vulnerability CVE-2020-15168 is introduced by package node-fetch #53

ayaka-kms opened this issue Aug 9, 2021 · 1 comment
Labels
good first issue Good for newcomers

Comments

@ayaka-kms
Copy link

ayaka-kms commented Aug 9, 2021 •
edited
Loading

Hi, @echoulen, a vulnerability CVE-2020-15168 is introduced in [email protected] via:
● [email protected] ➔ [email protected] ➔ [email protected] ➔ [email protected] ➔ [email protected]

However, recompose is a legacy package, which has not been maintained for about 3 years.
Is it possible to migrate recompose to other package to remediate this vulnerability?

I noticed several migration records in other js repo for storybook-addon-styled-component-theme:

  1. in react-dnd, version 7.4.1 ➔ 7.4.2, remove recompose via commit
  2. in @nivo/legends, version 0.67.0 ➔ 0.68.0, remove recompose via commit

Thanks.
@echoulen echoulen added the good first issue Good for newcomers label Sep 10, 2021
@landsman
Copy link

landsman commented Feb 1, 2022

@echoulen hey can you please update that?

@timroes timroes mentioned this issue Feb 23, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
good first issue Good for newcomers
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@landsman @echoulen @ayaka-kms