haul icon indicating copy to clipboard operation
haul copied to clipboard

update the lockfile to automatically remove the high severity vulnerability introduced in @haul-bundler/core

Open paimon0715 opened this issue 4 years ago • 0 comments

Hi, @zamotany, I have reported a vulnerability issue in package terminal-kit.

As far as I am aware, vulnerability(high severity) SNYK-JS-TREEKIT-1077068 detected in package tree-kit(<0.7.0) is directly referenced by  [email protected], on which your package @haul-bundler/[email protected] directly depends. As such, this vulnerability can also affect @haul-bundler/[email protected] via the following path: @haul-bundler/[email protected][email protected][email protected](vulnerable version)

Since terminal-kit has released a new patched version [email protected] to resolve this issue ([email protected][email protected](fix version)), then this vulnerability patch can be automatically propagated into your project only if you update your lockfile. The following is your new dependency path : @haul-bundler/[email protected][email protected][email protected](vulnerability fix version).

dependency path

A warm tip.^_^ Best regards,

paimon0715 avatar Aug 20 '21 08:08 paimon0715