Skip to content

Remove dependency on hawk, upgrade request #347

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Mar 10, 2018
Merged

Remove dependency on hawk, upgrade request #347

merged 1 commit into from
Mar 10, 2018

Conversation

krotscheck
Copy link
Contributor

@krotscheck krotscheck commented Feb 15, 2018 •
edited
Loading

This patch removes the explicit dependency on hawk, and upgrades request
to the newest version. It also removes node 0.10 from the testing grid,
as this version has been EOL'd by the node foundation, and doesn't support
es6 syntax used in the newer introduced dependencies.

https://nodesecurity.io/advisories/566
https://hackerone.com/reports/310439
https://github.com/nodejs/Release

Closes #346

@krotscheck
Copy link
Contributor Author

The only mention of hawk appears to be the package.json file:
https://github.com/mapbox/node-pre-gyp/search?utf8=%E2%9C%93&q=hawk&type=

@SebastianSchmidt
Copy link

SebastianSchmidt commented Feb 15, 2018 •
edited
Loading

The package [email protected] depends on [email protected].
This pull request does not completely remove the dependency on hawk and does not solve #346:

[email protected] › [email protected] › [email protected] › [email protected]
[email protected] › [email protected] › [email protected] › [email protected] › [email protected]
[email protected] › [email protected] › [email protected] › [email protected] › [email protected]
[email protected] › [email protected] › [email protected] › [email protected] › [email protected] › [email protected]

Updating to [email protected] fixes the vulnerability.
[email protected] uses [email protected] which depends on [email protected] (hapijs/hoek#230):

[email protected] › [email protected] › [email protected] › [email protected]
[email protected] › [email protected] › [email protected] › [email protected] › [email protected]
[email protected] › [email protected] › [email protected] › [email protected] › [email protected]
[email protected] › [email protected] › [email protected] › [email protected] › [email protected] › [email protected]

@krotscheck
Copy link
Contributor Author

@SebastianSchmidt Done. Jetzt auf Travis warten ⏳

@SebastianSchmidt
Copy link

[email protected] and Node 0.10: #320, #342

@krotscheck
Remove dependency on hawk, upgrade request
eda90e0 
This patch removes the explicit dependency on hawk, and upgrades request
to the newest version. It also removes node 0.10 from the testing grid,
as this version has been EOL'd by the node foundation, and doesn't support
es6 syntax used in the newer introduced dependencies.

https://nodesecurity.io/advisories/566
https://hackerone.com/reports/310439
https://github.com/nodejs/Release

Closes #346
@krotscheck krotscheck changed the title Remove dependency on hawk Remove dependency on hawk, upgrade request Feb 15, 2018
@krotscheck
Copy link
Contributor Author

Yeah, saw that. Given that node 0.10 is EOL, I removed it from the testing grid.

@krotscheck
Copy link
Contributor Author

@springmeyer Any chance you can take a look at this?

@JulianLaval
Copy link

Would be great to have this PR merged in -- any updates? 🙂

@kontrollanten
Copy link

Any updates on this?

kontrollanten added a commit to kontrollanten/algolia-places-react that referenced this pull request Feb 24, 2018
@kontrollanten
remove babel-cli
da84505 
Waiting for mapbox/node-pre-gyp#347
kontrollanten added a commit to kontrollanten/algolia-places-react that referenced this pull request Feb 24, 2018
@kontrollanten
remove babel-cli
8ea47d7 
Waiting for mapbox/node-pre-gyp#347
@gilmillasseau gilmillasseau mentioned this pull request Feb 28, 2018
Merged
@SebastianSchmidt SebastianSchmidt mentioned this pull request Mar 4, 2018
Closed
@Pablodotnet
Copy link

Any updates on this? We need the merge ASAP!

@matteofigus matteofigus mentioned this pull request Mar 7, 2018
Closed
@nhodges
Copy link

nhodges commented Mar 7, 2018

Whoops, just saw this PR. I also made a PR to address this, #349. Many packages are waiting on this so it can go upstream.

@lilyissillyyy lilyissillyyy mentioned this pull request Mar 8, 2018
Closed
@ronkorving
Copy link

Yeah, waiting too. Does node-pre-gyp only have a single maintainer?

@nuri-hodges-ck nuri-hodges-ck mentioned this pull request Mar 9, 2018
Closed
@fenichelar
Copy link

Merging this PR and releasing a new version would be great! :)

@springmeyer
Copy link
Contributor

Thanks for this PR. Sorry for the wait in review/merging. Will merge now and release as v0.7.0.

@springmeyer springmeyer merged commit af507d1 into mapbox:master Mar 10, 2018
@springmeyer
Copy link
Contributor

[email protected] is now published: https://www.npmjs.com/package/node-pre-gyp

This was referenced Mar 10, 2018
Closed
Closed
Closed
Closed
@fenichelar fenichelar mentioned this pull request Mar 10, 2018
Closed
@jinwoo jinwoo mentioned this pull request Mar 10, 2018
Closed
@andyhayes andyhayes mentioned this pull request Mar 12, 2018
Closed
joemphilips added a commit to joemphilips/walletts-old that referenced this pull request Mar 17, 2018
@joemphilips
remove test files from main(and module)build
58b775c 
* This commit still doesn't pass volnurability check. But it will be
solved soon enough
* refs: mapbox/node-pre-gyp#347
@krotscheck krotscheck deleted the hawk branch April 17, 2018 00:11
@fenichelar fenichelar mentioned this pull request Apr 20, 2018
Closed
@drewjenkins drewjenkins mentioned this pull request May 23, 2018
Closed
This was referenced Aug 5, 2021
Open
Open
@snyk-bot snyk-bot mentioned this pull request Sep 1, 2021
Open
hyj1991 pushed a commit to X-Profiler/node-pre-gyp that referenced this pull request Jun 16, 2023
@springmeyer
Merge pull request mapbox#347 from krotscheck/hawk
5b60326 
Remove dependency on hawk, upgrade request
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@matteofigus matteofigus matteofigus approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
10 participants
@krotscheck @SebastianSchmidt @JulianLaval @kontrollanten @Pablodotnet @nhodges @ronkorving @fenichelar @springmeyer @matteofigus