RealFaviconGenerator/cli-real-favicon

Update `debug` dependencies for security

Closed this issue · 3 comments

I ran npm audit to see if there were any vulnerabilities (the report is below) and it appears the debug library is a dep of a dep and wondering if updating the consuming package will fix. Its low priority but just wanted to raise it to your attention. Thanks for this package and all of your hard work.

                       === npm audit security report ===

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ debug                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >= 2.6.9 < 3.0.0 || >= 3.1.0                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ cli-real-favicon [dev]                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ cli-real-favicon > rfg-api > node-rest-client > debug        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/534                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 low severity vulnerability in 151 scanned packages
  1 vulnerability requires manual review. See the full report for details.```

Should be fixed by PR #8.

Pray for a merge and tag soon 🙏

0.0.7 has a clean audit. It was published a minute ago.

found 0 vulnerabilities

Thanks !