Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove minimist dependency #5513

Closed
comame opened this issue Mar 16, 2020 · 4 comments
Closed

Remove minimist dependency #5513

comame opened this issue Mar 16, 2020 · 4 comments

Comments

@comame
Copy link

comame commented Mar 16, 2020

Steps to reproduce

  • Puppeteer version: 2.1.1

What steps will reproduce the problem?

minimist has vulnerabilitiy GHSA-7fhm-mqm4-2wp7. This is required via extract-zip and mkdirp.

What is the expected result?
Remove extract-zip dependency. extract-zip is not updated since 2018.
@styfle
Copy link

styfle commented Mar 16, 2020

Consider using yauzl and fs.mkdir with the recursive flag instead of mkdirp.

@taewookim taewookim mentioned this issue Mar 20, 2020
Closed
@ABuffSeagull ABuffSeagull mentioned this issue Mar 20, 2020
Closed
@styfle
Copy link

styfle commented Apr 6, 2020

It looks like the latest version of extract-zip did just that, and it no longer depends on mkdirp.

max-mapper/extract-zip#89

Should I submit a PR to bump to extract-zip@2.0.0?

@comame
Copy link
Author

comame commented Apr 8, 2020

@styfle
Please make a PR. Thank you!

@styfle
Copy link

styfle commented Apr 11, 2020

Looks like @TimvdLippe already did in PR #5610

@comame comame closed this as completed Apr 12, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@styfle @comame