Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependency with security vulnerability #96

Open
Ashlayyy opened this issue Nov 10, 2024 · 0 comments
Open

Dependency with security vulnerability #96

Ashlayyy opened this issue Nov 10, 2024 · 0 comments

Comments

@Ashlayyy
Copy link

npm audit now gives a warning that vuejs3-datepickers depends on vulnerable versions of vite-plugin-dts. There is a fix available, but npm audit fix or with --force doesn't give the correct output. Could you update this depencen manually?

GHSA-g3ch-rx76-35fx

This is the full output of a npm audit: (It is in a project, so there are other dependencies, but it is also with brand new project)

npm audit report

vue-template-compiler >=2.0.0
Severity: moderate
vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS) - GHSA-g3ch-rx76-35fx
fix available via npm audit fix
node_modules/vue-template-compiler
@vue/language-core <=2.0.28
Depends on vulnerable versions of vue-template-compiler
node_modules/@vue/language-core
vite-plugin-dts 3.0.0-beta.1 - 4.0.0-beta.2
Depends on vulnerable versions of @vue/language-core
Depends on vulnerable versions of vue-tsc
node_modules/vite-plugin-dts
vuejs3-datepicker >=1.1.0
Depends on vulnerable versions of vite-plugin-dts
node_modules/vuejs3-datepicker
vue-tsc 1.7.0-alpha.0 - 2.0.28
Depends on vulnerable versions of @vue/language-core
node_modules/vue-tsc

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant