Vulnerable `debug` package about simple-commit-message HOT 6 CLOSED

npm audit raises this package to have vulnerable dependencies.

It has a dependency on a version of inquirer-confirm that has vulnerabilities because it depends on a vulnerable version of lodash. The most recent version of inquirer-confirm should probably fix this. You can confirm by running npm audit after updating your dependencies.

from simple-commit-message.

I opened PR #22 upgrading all dependencies to their latest versions, which should fix npm audit security vulnerabilities.

@bahmutov could you please have a look at it?

from simple-commit-message.

I think I found the problem, using snyk.

Introduced through: hela-config-tunnckocore@tunnckocore/hela-config-tunnckocore#e2afdc
› [email protected] › [email protected] › [email protected]

Introduced through: hela-config-tunnckocore@tunnckocore/hela-config-tunnckocore#e2afdc
› [email protected] › [email protected] › [email protected] › [email protected]

Introduced through: hela-config-tunnckocore@tunnckocore/hela-config-tunnckocore#e2afdc
› [email protected] › [email protected]

So, the problem is in the ggit :)

from simple-commit-message.

is this still a problem? I upgraded all dependencies

from simple-commit-message.

Not sure. Can't check soon. Probably next week.

You can assign me for reminder.

from simple-commit-message.

yeah, the lodash version needs to be updated. But it looks like its a sub dependency:

• simple-commit-message > ggit > lodash
• simple-commit-message > inquirer-confirm > inquirer > lodash

from simple-commit-message.