Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Dependencies that are Deprecated and Security Vulnerable #1

Open
sreev opened this issue Jun 15, 2024 · 0 comments
Open

Fix Dependencies that are Deprecated and Security Vulnerable #1

sreev opened this issue Jun 15, 2024 · 0 comments

Comments

@sreev
Copy link

sreev commented Jun 15, 2024

% npm install zerog-da-sdk ethers
npm warn deprecated [email protected]: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated [email protected]: Glob versions prior to v9 are no longer supported
npm warn deprecated [email protected]: Glob versions prior to v9 are no longer supported
npm warn deprecated [email protected]: Glob versions prior to v9 are no longer supported
npm warn deprecated [email protected]: Glob versions prior to v9 are no longer supported
npm warn deprecated [email protected]: Glob versions prior to v9 are no longer supported
npm warn deprecated [email protected]: Glob versions prior to v9 are no longer supported

added 408 packages, and audited 409 packages in 18s

3 moderate severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.

Run `npm audit` for details.

0g-ts-sdk % npm audit
# npm audit report

axios  0.8.1 - 0.27.2
Severity: moderate
Axios Cross-Site Request Forgery Vulnerability - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx

Will install [email protected], which is a breaking change
node_modules/axios
  open-jsonrpc-provider  *
  Depends on vulnerable versions of axios
  node_modules/open-jsonrpc-provider
    zerog-da-sdk  >=0.1.1
    Depends on vulnerable versions of open-jsonrpc-provider
    node_modules/zerog-da-sdk

3 moderate severity vulnerabilities
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant