jpeg-js dependency needs updating

Question

neilenns opened this issue 4 years ago · comments

The version of jpeg-js referenced in this package is subject to a moderate level security vulnerability (https://nvd.nist.gov/vuln/detail/CVE-2020-8175).

The package should be updated to require version 0.4.0 of jpeg-js or higher.

I found this because of a Dependabot warning in github for a project I maintain that uses pureimage.

Josh Marinacci · Answer 1 · Sat Aug 01 2020 00:34:41 GMT+0800 (China Standard Time)

fixed. thanks for catching that.

Neil Enns · Answer 2 · Sat Aug 01 2020 00:37:13 GMT+0800 (China Standard Time)

Thanks for the quick fix!