Giters

mapbox / geojson-rewind

enforce polygon ring winding order for geojson

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Using sharkdown which uses minimist with a CVE

daveisfera opened this issue · comments

commented

Duplicate of #25.

commented

@asheemmamoowala: This might not have been an exact duplicate. #25 does fix the version of minimist used directly by geojson-rewind. However, geojson-rewind's dependency on sharkdown still introduces a nested dependency on minimist 0.0.5, which has the security alert on it: https://github.com/tmcw-up-for-adoption/sharkdown/blob/v0.1.1/package.json#L14 So this means that geojson-rewind will still produce security alerts due to this nested dependency. Here's a result of npm/yarn audit:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.2.1 <1.0.0 || >=1.2.3                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ mapbox-gl                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ mapbox-gl > @mapbox/geojson-rewind > sharkdown > minimist    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1179                        │
└───────────────┴──────────────────────────────────────────────────────────────┘