Skip to content

Update vulnerable dependency (static-eval) #34

Closed

Description

@cp4r3z

https://nodesecurity.io/advisories/548

Remediation: Upgrade to static-eval 2.0

Activity

  1. pirosikick commented on Oct 20, 2017

    @pirosikick

    👍

  2. yoshuawuyts commented on Oct 20, 2017

    @yoshuawuyts
    Member

    PR welcome!

  3. danez commented on Oct 20, 2017

    @danez

    Without a changelog of static-eval@2 it is rather hard to figure out what the breaking change is and how it affects this module.

  4. yoshuawuyts commented on Oct 20, 2017

    @yoshuawuyts
    Member

    @danez I think if the tests pass we should merge it — it's trading off a known bug against a hypothetical bug; this is a fix.

    Agree it'd be nice if we could test this ahead of time on dependents, but we don't have the infra setup for that now, and don't think we should hold off merging this patch until then. Hope this makes sense!

  5. dyaa commented on Oct 25, 2017

    @dyaa

    Any updates !

  6. cp4r3z commented on Oct 26, 2017

    @cp4r3z
    Author

    Looks like PR #36 might also address the problem, but is more involved. Sounds like @lguzzon has the tests succeeding as well.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions