npm install: 3 vulnerabilities (2 low, 1 high)

[fnbk]

The current package [email protected] has a vulnerability, because the transitive dependency [email protected] is used in @pawelgalazka/cli more details

Merging the dependabot PR should easily solve this issue.

$ npm audit
# npm audit report

lodash  <=4.17.20
Severity: high
Prototype Pollution - https://npmjs.com/advisories/1523
Command Injection - https://npmjs.com/advisories/1673
No fix available
node_modules/@pawelgalazka/cli/node_modules/lodash
  @pawelgalazka/cli  *
  Depends on vulnerable versions of lodash
  node_modules/@pawelgalazka/cli
    tasksfile  *
    Depends on vulnerable versions of @pawelgalazka/cli
    node_modules/tasksfile

3 vulnerabilities (2 low, 1 high)

Some issues need review, and may require choosing
a different dependency.

[fnbk]

@pawelgalazka What do you think? When could you do that?

[henhal]

@pawelgalazka Any updates? See https://github.com/pawelgalazka/cli/issues/11

[henhal]

Six months later and this still causes audit warnings for me, would you consider upgrading lodash via the dependabot PR and/or switching to caret notation for dependencies so that user can override it in their lock files? @pawelgalazka

[binaryben]

I like the simplicity of this, but it might be time to fork and keep it actively maintained. Audit warnings a year on are a problem.