Security warnings about set-value and http-proxy about caravan HOT 5 OPEN

@sgeisler thanks for the bug report!

Not sure if this an option for you but if you upgrade your version of nodejs and npm, rm -fr node_modules, and npm i again you should see the following (I used nvm to test in node.js 12 and 13):

found 3 low severity vulnerabilities
  run `npm audit fix` to fix them, or `npm audit` for details

from caravan.

Thx for the quick reply! I'm not too concerned about it for myself (have it running in a restricted environment anyway), just wanted to let you know. I fear debian doesn't ship any more recent versions and I don't want to alter the system too much just for that.

So if you can fix it by upgrading some dep: great (I assume that's what npm audit fix would do?)! If it's just a reporting error due to old npm: my bad, feel free to close.

from caravan.

I believe some of the dependencies need to be bumped manually (not just npm audit fix) as they could result in some breaking changes (minor or major changes rather than just a patch) and so will need some testing.

Thanks for reporting!

from caravan.

I don't see this high vulnerability with the latest version but 5000 low-level vulnerabilities, where npm audit fix fixes 4999 of them.

Should I start a PR with the updated package.json and package-lock.json?

from caravan.

Should I start a PR with the updated package.json and package-lock.json?

💯 PRs are always welcome!

from caravan.