jaredhanson/passport-twitter

Dependency problem: 3 vulnerabilities (2 moderate, 1 critical)

Opened this issue · 3 comments

amochkin commented

Dependency warning upon installation of passport-twitter.

Expected behavior

No warnings.

Actual behavior

$ npm i passport-twitter
3 vulnerabilities (2 moderate, 1 critical)

$ npm audit
node_modules/xmldom
  xtraverse  *
  Depends on vulnerable versions of xmldom
  node_modules/xtraverse
    passport-twitter  >=1.0.0
    Depends on vulnerable versions of xtraverse
    node_modules/passport-twitter

Steps to reproduce

$ npm i passport-twitter

Environment

  • Operating System: MacOS
  • Node version: 20
  • passport version: 0.6.0
  • passport-twitter version: 1.0.4
amochkin commented

Need to bump those deps. Thanks!

Squishey commented

any solution about those 3 vulnerabilites? One of those being critical!

Olliebrown commented

I noticed there is a PR that fixes this problem with some simple changes to the code. To use this version instead, just run:
npm i https://github.com/ncluer/passport-twitter.git

That will install directly from the repository with the needed fixes. PR is here: #124

  • ❤️1