Giters

thiagobustamante / typescript-rest

This is a lightweight annotation-based expressjs extension for typescript.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Requesting to upgrade few internal dependent packages which seems to have potential fixes reported in OSS CVE

mannerni opened this issue · comments

commented

Request to upgrade & known timeline for the same would help.

  1. cookie: upgrade to 0.4.1 (Has Fix maxAge option to reject invalid values. Link: https://github.com/jshttp/cookie/releases/tag/v0.4.1.)
  2. util: upgrade to 0.12.4.
  3. string_decoder: upgrade to 1.3.0
  4. readable-stream: upgrade to 3.6.0
    Also would like to understand the impact when users do not use such code (above ones) directly, is it safe to say that internally also these package code is not used untill then?