typescript-rest icon indicating copy to clipboard operation
typescript-rest copied to clipboard

Published 20 hours ago • verified publisher icon thiagobustamante

Requesting to upgrade few internal dependent packages which seems to have potential fixes reported in OSS CVE

Open mannerni opened this issue 4 years ago • 0 comments

Request to upgrade & known timeline for the same would help.

  1. cookie: upgrade to 0.4.1 (Has Fix maxAge option to reject invalid values. Link: https://github.com/jshttp/cookie/releases/tag/v0.4.1.)
  2. util: upgrade to 0.12.4.
  3. string_decoder: upgrade to 1.3.0
  4. readable-stream: upgrade to 3.6.0 Also would like to understand the impact when users do not use such code (above ones) directly, is it safe to say that internally also these package code is not used untill then?

mannerni avatar Jul 12 '21 13:07 mannerni