Chartmogul-node depends on deprecated package with known vulnerability

[jsedlacek]

Chartmogul-node depends on deprecated package with known vulnerability

[galadim1]

Hello @jsedlacek Thank you for reporting this issue. We would take a look at it.

[alexleonov-tactiq]

We would take a look at it.

It's been a while, any updates @galadim1 ?

[galadim1]

We would take a look at it.

It's been a while, any updates @galadim1 ?

Hi, this is still in our backlog and we will get to it soon.

[alexleonov-tactiq]

@galadim1 sorry to be a pain in the back, but how does not resolving a vulnerability for more than six months fit into your SOC 2 compliance? :) we'll have to drop this library just because it is considered insecure by any measure...

[galadim1]

@galadim1 sorry to be a pain in the back, but how does not resolving a vulnerability for more than six months fit into your SOC 2 compliance? :) we'll have to drop this library just because it is considered insecure by any measure...

Sorry, it took so long. We have a bigger plan with all ChartMogul client Libraries and the reason for the delay (decision-making). the team in charge has started working on the updates for the node client library and in the coming weeks, we will have an updated version.