web-ext icon indicating copy to clipboard operation
web-ext copied to clipboard

Upgrade from vulnerable hoek dependency

Open LinusU opened this issue 7 years ago • 0 comments

This will probably require some work in our dependencies, but it would be very nice if we could get rid of old hoek versions, as they have been marked vulnerable on snyk.

https://snyk.io/vuln/npm:hoek:20180212

While I don't think see how this could affect web-ext at all, it will still trigger warnings like this for repositories depending on it:

screen shot 2018-05-04 at 11 25 52

This is the dependency graph:

└─┬ [email protected]
  ├─┬ [email protected]
  │ └─┬ [email protected]
  │   └─┬ [email protected]
  │     └─┬ [email protected]
  │       ├─┬ [email protected]
  │       │ └── [email protected]  deduped
  │       ├─┬ [email protected]
  │       │ └─┬ [email protected]
  │       │   └── [email protected]  deduped
  │       ├── [email protected] 
  │       └─┬ [email protected]
  │         └── [email protected]  deduped
  └─┬ [email protected]
    ├─┬ [email protected]
    │ └─┬ [email protected]
    │   ├── [email protected] 
    │   └─┬ [email protected]
    │     └── [email protected] 
    └─┬ [email protected]
      └─┬ [email protected]
        ├─┬ [email protected]
        │ └── [email protected]  deduped
        ├── [email protected] 
        └─┬ [email protected]
          └── [email protected]  deduped

What is the current behavior?

  • Shows warnings

What is the expected or desired behavior?

  • Does not show warnings

Version information (for bug reports)

  • Firefox version: n/a
  • Your OS and version: n/a
  • Paste the output of these commands:
$ node --version && npm --version && web-ext --version
v9.11.1
5.6.0
2.6.0

LinusU avatar May 04 '18 09:05 LinusU