austinpray/asset-builder

Need to update object-path dependency.

joelschlotterer opened this issue · 2 comments

───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ object-path │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.11.5 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ asset-builder [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ asset-builder > object-path │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/1573

It's been fixed in #79 but still waiting author to release the new version :D hope author will have time soon.

Meanwhile, I am using npm-force-resolutions to get rid of all the issues from the packages. If you want to solve the issues then you can follow these steps:

First, you need to add new script "preinstall": "npx npm-force-resolutions" in you package.json
Your scripts code will look like this:

"scripts": {
    "preinstall": "npx npm-force-resolutions",
    // Other scripts goes here.
}

Then in your package.json, you'll have to add a new node "resolutions" and inside that, you'll have to specify the package name and version that suggested to fix the issue.

In the case of asset-builder the code will look like this:

"resolutions": {
    "object-path": "^0.11.8"
}

then run the npm install and the issue will be removed for object-path