Open
Description
ACTUAL BEHAVIOR
npm audit fails with security vulnerability in axios dependency
STEPS TO REPRODUCE
$ npm i -S @inplayer-org/[email protected]
npm WARN deprecated [email protected]: Package has been renamed to @fingerprintjs/fingerprintjs. Install @fingerprintjs/fingerprintjs to get updates.
npm WARN deprecated [email protected]: Critical security vulnerability fixed in v0.21.1. For more information, see https://github.com/axios/axios/pull/3410
added 69 packages, and audited 70 packages in 8s
12 packages are looking for funding
run `npm fund` for details
2 high severity vulnerabilities
To address all issues (including breaking changes), run:
npm audit fix --force
Run `npm audit` for details.
$ npm audit
# npm audit report
axios <=0.21.1
Severity: high
Incorrect Comparison in axios - https://github.com/advisories/GHSA-cph5-m8f7-6c5x
Server-Side Request Forgery in Axios - https://github.com/advisories/GHSA-4w2v-q235-vp99
fix available via `npm audit fix --force`
Will install @inplayer-org/[email protected], which is a breaking change
node_modules/axios
@inplayer-org/inplayer.js >=3.0.0-beta.0
Depends on vulnerable versions of axios
node_modules/@inplayer-org/inplayer.js
2 high severity vulnerabilities
To address all issues (including breaking changes), run:
npm audit fix --force
Metadata
Metadata
Assignees
Labels
No labels