Security Issue with Dependency vm2

[ahester-incomm]

According to the maintainer, the security issue cannot be properly addressed and the library will be discontinued.

From snyk.

Also see GitHub issue.

[deanro]

I haven't used yarn before but as far as I can see it looks like vm2 is being brought in ultimately via the version of proxy-agent dependency that is being used. I did a local test to upgrade proxy-agent to the latest version and vm2 has gone away and as far as I can see everything still works. However I could be missing something as I haven't had reason to install yarn before tonight :-)

[kevinappen]

Thanks @deanro for looking at this. I'm just wondering what is needed to have your pull request merged into the main branch, and if there's anything we (the public) can do to help?

[ahester-incomm]

@kevinappen This repository is in need of maintainers. One of the open issues (#300) is seeking maintainers.

[deanro]

I tested it locally and everything looked good. I think someone just needs to approve and merge it.

[kevinappen]

@kevinappen This repository is in need of maintainers. One of the open issues (#300) is seeking maintainers.

@ahester-incomm yeah, I realise that, and I didn't mean to hassle anyone unduly. I appreciate it's a voluntary thing, and everyone has other things that take precedence. I myself don't have any Node experience at all, so couldn't help directly, but I thought some people had recently put their hands up to take on the maintenance so that's why I asked if we, the general public, could help at all.

[ahester-incomm]

@kevinappen This repository is in need of maintainers. One of the open issues (#300) is seeking maintainers.

@ahester-incomm yeah, I realise that, and I didn't mean to hassle anyone unduly. I appreciate it's a voluntary thing, and everyone has other things that take precedence. I myself don't have any Node experience at all, so couldn't help directly, but I thought some people had recently put their hands up to take on the maintenance so that's why I asked if we, the general public, could help at all.

I guess we can start by commenting on this issue more so it gets more attention.