Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security - Deprecated dependency (Request) #35

Open
Hanifb opened this issue Sep 23, 2024 · 1 comment
Open

Security - Deprecated dependency (Request) #35

Hanifb opened this issue Sep 23, 2024 · 1 comment

Comments

@Hanifb
Copy link

Hanifb commented Sep 23, 2024

Request is now deprecated - it has several unadressed issues.

Server-Side Request Forgery in Request - GHSA-p8p7-x288-28g6
tough-cookie Prototype Pollution vulnerability - GHSA-72xf-g2v4-qvf3

@dcnl1980
Copy link

Same here, any updates?

npm audit report

request *
Severity: moderate
Server-Side Request Forgery in Request - GHSA-p8p7-x288-28g6
Depends on vulnerable versions of tough-cookie
fix available via npm audit fix --force
Will install @getbrevo/brevo@1.0.1, which is a breaking change
node_modules/request
@getbrevo/brevo >=2.0.0-beta.2
Depends on vulnerable versions of request
node_modules/@getbrevo/brevo

tough-cookie <4.1.3
Severity: moderate
tough-cookie Prototype Pollution vulnerability - GHSA-72xf-g2v4-qvf3
fix available via npm audit fix --force
Will install @getbrevo/brevo@1.0.1, which is a breaking change
node_modules/tough-cookie

3 moderate severity vulnerabilities

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants