Heikki Pora

npm audit reports RegEx vulnerability in dependency (clean-css)

3

Need to update `clean-css`: ``` ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ Low │ Regular Expression Denial of Service │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ clean-css │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ >=4.1.11 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │...

Example: verdaccio depends on node-fetch@cjs, where "cjs" is defined currently as version 2.6.7 in dist-tags Installation of verdaccio (from a mirror) thus fails as dist-tags only contains "latest" in the...

See e.g. https://github.com/heikkipora/gitlab-radiator/issues/73

/runners/all - requires admin privileges and needs to be configurable for that reason

Package version dependency via dist-tags is not resolved

1

example: `verdaccio-audit` depends on `node-fetch@cjs` (which is defined as v2.6.7 in node-fetch's metadata) This should bring in `[email protected]` to the synced package set but does not Related issue: https://github.com/heikkipora/registry-sync/issues/57