louischatriot / nedb

The JavaScript Database, for Node.js, nw.js, electron and the browser

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Please update dependency underscore

jfoclpf opened this issue · comments

@louischatriot please just update dependency underscore as it is tagged as high vulnerability

# npm audit report

nedb  *
Severity: high
Prototype Pollution - https://github.com/advisories/GHSA-339j-hqgx-qrrx
Depends on vulnerable versions of binary-search-tree
Depends on vulnerable versions of underscore
No fix available
node_modules/nedb

underscore  1.3.2 - 1.12.0
Severity: high
Arbitrary Code Execution in underscore - https://github.com/advisories/GHSA-cf4h-3jhx-xvhq
No fix available
node_modules/underscore
  binary-search-tree  *
  Depends on vulnerable versions of underscore
  node_modules/binary-search-tree

3 high severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.

Incase anyone is still looking for a solution try gray-nedb. I've upgraded some code.

Incase anyone is still looking for a solution try gray-nedb. I've upgraded some code.

Thanks! Are you planning to do any updates further?

Incase anyone is still looking for a solution try gray-nedb. I've upgraded some code.

Thanks! Are you planning to do any updates further?

I do want to properly maintain the code, can't guarantee it though.