-
Notifications
You must be signed in to change notification settings - Fork 182
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update vulnerable dependencies #226
Conversation
- diff (via vows): GHSA-h6ch-v84p-w6p9 - async (via winston): GHSA-fwr7-v2mv-hh25 Related db-migrate/node-db-migrate#779 Related 4736c82 Closes flatiron#195
This will need work for the winston upgrade:
|
you probably need to remove the |
Hello there, upgrading to winston@3 can be a bit challenging as it brings a ton of breaking changes. |
Hi, yes feel free to jump in here. Thanks! |
I have made this MR winstonjs/winston#2112 a while ago and I was waiting for it to get merged and released, it is about backport the async vulnerability fox to the winston 2.x so intead of upgrading it to 3.x in this MR and suffer we can set the version to ^2.4.6 which has the fix |
Thank you! I'll close this PR. Can #195 also be closed? |
diff (via vows): GHSA-h6ch-v84p-w6p9
async (via winston): GHSA-fwr7-v2mv-hh25
Related db-migrate/node-db-migrate#779
Related 4736c82
Closes #195