Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes #23 #24

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Fixes #23 #24

wants to merge 3 commits into from

Conversation

sobolevn
Copy link

@sobolevn sobolevn commented Dec 2, 2019

I've done several things here:

npm audit

npm audit said that this package contains several security vulnerabilities:

found 8 vulnerabilities (1 low, 5 high, 2 critical)
  run `npm audit fix` to fix them, or `npm audit` for details

I have fixed them like so:

» npm audit fix
npm WARN eslint-plugin-vue-a11y@0.0.31 No repository field.

added 1 package from 1 contributor and updated 2 packages in 4.347s
fixed 6 of 8 vulnerabilities in 330 scanned packages
  1 package update for 2 vulnerabilities involved breaking changes
  (use `npm audit fix --force` to install breaking changes; or refer to `npm audit` for steps to fix these manually)

» npm audit
                                                                                
                       === npm audit security report ===                        
                                                                                
# Run  npm install --save-dev mocha@6.2.2  to resolve 2 vulnerabilities
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Critical      │ Command Injection                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ growl                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ mocha [dev]                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ mocha > growl                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/146                             │
└───────────────┴──────────────────────────────────────────────────────────────┘


┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ debug                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ mocha [dev]                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ mocha > debug                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/534                             │
└───────────────┴──────────────────────────────────────────────────────────────┘


found 2 vulnerabilities (1 low, 1 critical) in 331 scanned packages
  2 vulnerabilities require semver-major dependency updates.

» npm install --save-dev mocha@6.2.2
npm WARN eslint-plugin-vue-a11y@0.0.31 No repository field.

+ mocha@6.2.2
added 36 packages from 16 contributors, removed 14 packages, updated 8 packages and audited 463 packages in 10.048s
found 0 vulnerabilities

Now, all packages are safe!

package.json warnings

I have fixed npm WARN eslint-plugin-vue-a11y@0.0.31 No repository field. by adding a repository field.

Tests and linter

I have fixed all npm run lint issues and fixed test to pass

travis ci

I have added .travis.yml so you can have a ci for each push. It should just work after enabling this repo at https://travis-ci.com/

new dependencies

I have fixed #23 and updated dependencies.

@genevagrant
Copy link

Hey @maranran
Love the repo - any idea if/when you could take a look at @sobolevn 's PR?

Hoping to use this with latest eslint

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Old dependency versions
2 participants