Skip to content

Updated request to avoid security vulnerability in dep#20

Closed
rankida wants to merge 1 commit into
npm:latestfrom
rankida:request-update
Closed

Updated request to avoid security vulnerability in dep#20
rankida wants to merge 1 commit into
npm:latestfrom
rankida:request-update

Conversation

@rankida

@rankida rankida commented Jul 18, 2018

Copy link
Copy Markdown

Hi,

Older versions of hoek have a security vulnerability https://snyk.io/vuln/npm:hoek:20180212 and this is pulled in by old versions of request.

This PR simply bumps request to to 2.87.0 (from 2.81.0) to avoid this issue.

Please let me know if I have done anything wrong with this PR.

Thanks!

@rankida rankida requested a review from a team as a code owner July 18, 2018 09:39
@zkat

zkat commented Jul 18, 2018

Copy link
Copy Markdown
Contributor

We are intentionally not upgrading request to 2.87.0 until node-gyp gets around to unpinning that package. We can't really do much about it being in our tree, and having the toplevel request be a different version than what node-gyp uses is significantly increasing the package size for our distributed tarball.

As far as we're concerned, the issues with hoek do not pose a risk to npm itself, which is why we decided to let the audit be a little noisy for now.

You wanna try and convince the node-gyp folks to fix that bit? :)

@zkat

zkat commented Jul 19, 2018

Copy link
Copy Markdown
Contributor

I'm gonna actually close this, and there's also a more thorough answer on the discussion board: https://npm.community/t/npm-i-npm-6-2-0-latest-shows-security-noise/709/3

tl;dr you're safe. Like, for sure.

@zkat zkat closed this Jul 19, 2018
@rankida

rankida commented Jul 19, 2018

Copy link
Copy Markdown
Author

Thanks for taking the time to reply.

Cheers!

@maclover7 maclover7 mentioned this pull request Aug 9, 2018
koralle pushed a commit to koralle/npm-cli that referenced this pull request Feb 11, 2026
Jah-yee pushed a commit to Jah-yee/cli that referenced this pull request Apr 16, 2026
github-actions Bot added a commit to Kevinlee7250/cli that referenced this pull request Jun 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants