Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Please update the package #133

Open
subhasishdas159 opened this issue Oct 16, 2021 · 1 comment
Open

Please update the package #133

subhasishdas159 opened this issue Oct 16, 2021 · 1 comment

Comments

@subhasishdas159
Copy link

This error came while I used it with sveltekit

npm audit report

axios <=0.21.1
Severity: high
Incorrect Comparison in axios - GHSA-cph5-m8f7-6c5x
Server-Side Request Forgery in Axios - GHSA-4w2v-q235-vp99
fix available via npm audit fix --force
Will install [email protected], which is a breaking change
node_modules/@cloudflare/wrangler/node_modules/axios
node_modules/axios
svelte-image >=0.0.5
Depends on vulnerable versions of axios
Depends on vulnerable versions of svgo
node_modules/svelte-image

nth-check <2.0.1
Severity: moderate
Inefficient Regular Expression Complexity in nth-check - GHSA-rp65-9cf3-cjxr
fix available via npm audit fix --force
Will install [email protected], which is a breaking change
node_modules/nth-check
css-select <=3.1.0
Depends on vulnerable versions of nth-check
node_modules/css-select
svgo 1.0.0 - 1.3.2
Depends on vulnerable versions of css-select
node_modules/svgo
svelte-image >=0.0.5
Depends on vulnerable versions of axios
Depends on vulnerable versions of svgo
node_modules/svelte-image

5 vulnerabilities (3 moderate, 2 high)

To address all issues (including breaking changes), run:
npm audit fix --force

@jaads
Copy link

jaads commented Jul 2, 2022

I agree. The package is very outdated. Please accept the PRs.

Here is my installation output:

npm WARN deprecated [email protected]: Modern JS already guarantees Array#sort() is a stable sort, so this library is deprecated. See the compatibility table on MDN: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/sort#browser_compatibility
npm WARN deprecated [email protected]: Critical security vulnerability fixed in v0.21.1. For more information, see https://github.com/axios/axios/pull/3410
npm WARN deprecated [email protected]: This SVGO version is no longer supported. Upgrade to v2.x.x.

added 187 packages, and audited 390 packages in 1m

6 high severity vulnerabilities

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants