Potential security vulnerabilities in dependencies

[oasis-learn-study]

Potential security vulnerabilities in dependencies

[vorburger]

And separately a 3rd one get / parsejson https://nvd.nist.gov/vuln/detail/CVE-2017-16113

galkn/parsejson#4

[vorburger]

@edewit re-opening this issue, as from what I understood #101 only fixed url-parse but not parsejson?

https://github.com/vorburger/minecraft-storeys-maker/network/dependencies changed and the 1st point above but still shows (for me...) for the 2nd point above:

We found a potential security vulnerability in one of your dependencies.
A dependency defined in scratch/package-lock.json has known security vulnerabilities and should be updated.

[edewit]

@vorburger the issue doesn't state what version of parsejson it should be. e.g. parsejson doesn't have a newer version than 0.0.3

[vorburger]

@edewit from reading over galkn/parsejson#4 more closely than I have yesterday, and the gist of what they seem to be saying over there in that issue as well as on https://www.npmjs.com/advisories/528 is basically that parsejson is dead, and that the native JSON.parse() should be used instead, for both performance and security reasons. So it seems like we don't have to bump our parsejson usage version, but find out why (by what transitive dependency) we need it in the first place, and then try to bump that - or (help to?) get whatever other package is depending on it to get off it?

[vorburger]

@edewit closing this as GitHub no longer shows any vulnerabilities now - thank you!!