Comments (8)
@debrice: Yes, thank you, but not every project is using Yarn.
from node-static.
@brettz9 You can enforce the right version of minimist
if you use yarn by using the resolutions
feature in your package.json
file. I've successfully removed the vulnerability through this commit
Edited to point out that this solution will not work as of today if you use npm
from node-static.
Bump
from node-static.
+1
from node-static.
I might be mistaken but I found that installing npm-force-resolutions as a dev dependency and adding the following into the package.json
"resolutions": {
"minimist": "^1.2.5",
},
as well as the following script into my package.json: "preinstall": "npx npm-force-resolutions"
By then running npm run preinstall
and then npm i
it seemed to remove the audit issue around using minimist.
from node-static.
Looks like it's dead, last commit on master in 2018? Is there still somebody to merge? Then I maybe make a fork with a fix.
from node-static.
Is installing npm-force-resolutions as a dev dependency still the only (recommended) solution to the optimist/minimist issue?
npm audit
Low Prototype Pollution
Package minimist
Patched in >=0.2.1 <1.0.0 || >=1.2.3
Dependency of optimist
Path optimist > minimist
More info https://npmjs.com/advisories/1179
from node-static.
Closed by #227.
from node-static.
Related Issues (20)
- Publish latest version to npm HOT 5
- Hidden files/folders HOT 4
- "Range request exceeds file boundaries" in console HOT 2
- Version in Server header is still 0.7.9
- How do I set headers? HOT 2
- Error when processing range request using Chrome
- Post parameters HOT 1
- setTimeout not working? Can't throttle server...
- Security vulnerabilities HOT 2
- New fork resolving vulnerabilities and incorporating most current PRs HOT 33
- neodoc is a massive dependency HOT 4
- Publish New NPM version for Node-Static HOT 12
- Switch optimist to minimalist (dev-dependency) HOT 1
- Why this version? HOT 2
- Error: Class constructor Server cannot be invoked without 'new' HOT 2
- 404 page
- Update to latest mime-db, to send "text/javascript" MIME type for ".js" / ".mjs" files?
- [ERR_HTTP_HEADERS_SENT] after successfully requesting a file with "Range: bytes=0-" HOT 2
- low performance
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from node-static.