Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updated HAWK dep, and testing works #2748

Closed

Conversation

avdaredevil
Copy link

PR Checklist:

  • [~] I have run npm test locally and all tests are passing.

Upon running tests before any changes, it seems the tests might be broken:

> request@2.81.1 test <my_home>\Desktop\req-orig
> npm run lint && npm run test-ci && npm run test-browser

> request@2.81.1 lint <my_home>\Desktop\req-orig
> standard

> request@2.81.1 test-ci <my_home>\Desktop\req-orig
> taper tests/test-*.js

total ............................... 0/1

not ok
  • [~] I have added/updated tests for any new behavior.

Only the hawk dependency was updated due to a vulnerable sub-dependency called boom within the older version of Hawk

  • If this is a significant change, an issue has already been created where the problem / solution was discussed: NA

PR Description

Need to update the dependency hawk, since enterprise customers cannot use the vulnerable and deprecated boom@2.10.1 which is a sub-dependency within hawk. Simply updating hawk will update boom beyond version 5.2.0 which is considered not to be vulnerable. Thanks!

@avdaredevil
Copy link
Author

Any updates @jchris?

@jchris
Copy link
Contributor

jchris commented Sep 5, 2017

did you mean to tag me?

@gsmadi
Copy link

gsmadi commented Sep 8, 2017

This PR would be useful to merge as I too am having security flags raised about boom@2.10.1

@avdaredevil
Copy link
Author

@jchris Not sure, who to tag, as you show up as the first developer. I took a look at the contributions. I think @mikeal might be the right person.

@ashawley
Copy link

Fixed in #2751 and released in 2.82.0.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants