Vulnerability in sub-dependency, "debug"

[avindra]

PR is made upstream for the fix

max-mapper/extract-zip#52

phantomjs will also need to unlock the version number or bump it so that upgrades will pass through.

[avindra]

I would recommend using ^ in the dependencies, so that upgrades will automatically pass through, particularly because Medium has expressed that they are not interested in maintaining this package.

[kgrubb]

Extract-zip has been updated with a newer version of debug in 94b877a. According to NSP, there are no longer any known vulnerabilities for phantomjs-prebuilt! 🍰

[avindra]

@kgrubb NSP is incorrect. phantomjs-prebuilt still has to bump it's dependencies, or change the tilde to a caret to allow semver updates automatically.

PR here for the latter: #746

[kgrubb]

Oh duh, my apologies. I completely overlooked the package.json upgrade required for this package.

[avindra]

No worries. It seems that NSP needs to take into account how dependencies are resolved using semver in node land.

[avindra]

@kgrubb I was wrong.

Tilde means patch upgrades are allowed:

https://docs.npmjs.com/misc/semver#tilde-ranges-123-12-1

So NSP is correct, and this particular issue, is indeed fixed.