Upgrade `open` dependency

Question

Upgrade `open` dependency

ryw opened this issue 4 years ago · comments

Ry Walker commented 4 years ago

open 0.0.5 is vulnerable https://www.npmjs.com/advisories/663 - fixed in any version >0.0.5

Benjamin Gruenbaum · Answer 1 · Wed May 27 2020 16:07:20 GMT+0800 (China Standard Time)

Sure, though note bluebird has no dependencies and this is just a devDependency

Ry Walker · Answer 2 · Wed May 27 2020 20:29:39 GMT+0800 (China Standard Time)

For some reason Twistlock (CVE scanner from Palo Alto Networks) is alerting this CVE on our API image, possibly it's coming from some other dependency - will re-check.
/cc @samblackk

Ry Walker · Answer 3 · Thu May 28 2020 02:33:01 GMT+0800 (China Standard Time)

devDependency, closing.

Found this:

"The 'dependencies' and 'devDependencies' sections from package.json file may contain special metadata chars (~ and ^), which are picked up by Twistlock as part of the package version, causing these false positives. If using twistcli, these fields are evaluated when the -include-js-dependencies flag is set. These are also evaluated for images when the "Scan for vulnerable javascript package dependencies within images and functions" is toggled on." - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNXaCAO