<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clip

I don't get any warnings: <div class="highlight highlight-text-shell-session notra

👍 <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="

npm audit reports this package as problematic for prototype pollution about merge-options HOT 6 CLOSED

schnittstabil commented on July 23, 2024

npm audit reports this package as problematic for prototype pollution

from merge-options.

Comments (6)

vmx commented on July 23, 2024

The information is wrong, it was fixed in the 1.0.1 release.

I've asked on the npm forum on how to get that report fixed: https://npm.community/t/how-to-report-fixed-vulnerability/2943.

from merge-options.

vmx commented on July 23, 2024

The report got updated, you shouldn't get this warning anymore.

from merge-options.

franktopel commented on July 23, 2024

I assume the problem then is that webpack-command lists the dependency as "merge-options": "^1.0.0",. Sure it updates to 1.0.1 as so as anyone does npm i, but 1.0.0 is stil listed in package.json.

from merge-options.

vmx commented on July 23, 2024

I don't get any warnings:

$ npm install webpack-command
npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN [email protected] requires a peer of webpack@^4.4.0 but none is installed. You must install peer dependencies yourself.
npm WARN @webpack-contrib/[email protected] requires a peer of webpack@^3.0.0 || ^4.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @webpack-contrib/[email protected] requires a peer of webpack@^4.3.0 but none is installed. You must install peer dependencies yourself.
npm WARN webpackcommand No description
npm WARN webpackcommand No repository field.
npm WARN webpackcommand No license field.

+ [email protected]
added 206 packages from 115 contributors and audited 482 packages in 10.655s
found 0 vulnerabilities