Minimist dependency fails package audit about promster HOT 9 CLOSED

It may very well need to be fixed upstream. In my particular case, I am ok without the GC stats so maybe extracting those metrics into their own package. But that may be more of an annoyance than anything
But I get it, third (or nth) party audit problems are troublesome for everyone I just happened to "get it" from your dependency

from promster.

Thanks for reporting. Any suggestions on what we can do here specifically? Upon first sight it looks more like it needs fixing upstream?

from promster.

Yes, if I could I'd move away from a library not passing an audit but if it's a transitive dependency or a core dependency to the library I don't see how that's possible. Can you also open an issue upstream maybe?

from promster.

Yeah, I see the problem. I will try to identify where shall I open the issue. And let you know.

from promster.

So far:
Installing [email protected] -> no audit problems

I cannot install gc-stats because it cannot be built and there is no prebuilt binary. -> no audit problems

When I install @prompster/[email protected] -> the audit problems show off.

So, I am not really sure which upstream to create the issue in. no-pre-gyp has no issue and I cannot verify gc-stats because it does not build. Any hints?

from promster.

I also tried to install @promster/metrics with the --no-optional flag with no success, gc-stats still shows up in the package-lock and causes the audit problem

from promster.

gc-stats is an optional dependency to the metrics packages which in turn is used by all integrations. To me it looks like gc-stats usines mkdirp which uses minimist which has the issue. We could add a hard resolution to minimist here if it is fixed there. Do we know if it is?

from promster.

I am still looking for a solution, but some bigger fires need to be put down first 😉

from promster.

We finally decided to implement ourselves the metrics we need from fastify in a very non-generic manner.
Thanks for your help and your approach to metrics

from promster.