I ran npm audit today and a dependency of node-ipinfo has a vulnerability:
$ npm audit
=== npm audit security report ===
┌──────────────────────────────────────────────────────────────────────────────┐
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ Server-Side Request Forgery │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ axios │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.21.1 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ node-ipinfo │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ node-ipinfo > axios │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/1594 │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 high severity vulnerability in 447 scanned packages
It seems that upgrading an indirect package is complicated (see StackOverflow thread), so the easiest would be to change the version in package.json, I think.
I ran
npm audittoday and a dependency ofnode-ipinfohas a vulnerability:It seems that upgrading an indirect package is complicated (see StackOverflow thread), so the easiest would be to change the version in
package.json, I think.