Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Move away from unzipper which is unmaintained #166

Closed
apupier opened this issue Sep 12, 2022 · 0 comments · Fixed by #200
Closed

Move away from unzipper which is unmaintained #166

apupier opened this issue Sep 12, 2022 · 0 comments · Fixed by #200

Comments

@apupier
Copy link
Contributor

apupier commented Sep 12, 2022

unzipper seems unmaintained for quite some time now, last publish was 2 years ago https://www.npmjs.com/package/unzipper https://github.com/ZJONSSON/node-unzipper
It has a depdency on an archived an unmaintained fstream ZJONSSON/node-unzipper#261 which leads to a CVE reported by npm audit

minimist  <1.2.6
Severity: critical
Prototype Pollution in minimist - https://github.com/advisories/GHSA-xvch-5gv4-984h
fix available via `npm audit fix`
node_modules/minimist

it would be nice to move away from unzipper and use a maintained dependency.
apupier added a commit to apupier/vscode-test that referenced this issue Oct 26, 2022
@apupier
Use unzip-stream instead of unzipper
7f83374 
unzipper seems unmaintained for quite some time now, last publish was 2
years ago https://www.npmjs.com/package/unzipper
https://github.com/ZJONSSON/node-unzipper
It has a dependency on an archived an unmaintained fstream
ZJONSSON/node-unzipper#261 which leads to a CVE reported by npm audit

fixes microsoft#166
@apupier apupier mentioned this issue Oct 26, 2022
Closed
connor4312 added a commit that referenced this issue Feb 27, 2023
@connor4312
fix: remove dependency on unzipper package
b87c3c6 
Fixes #197
Fixes #166
@connor4312 connor4312 mentioned this issue Feb 27, 2023
Merged
connor4312 added a commit that referenced this issue Feb 27, 2023
@connor4312
fix: remove dependency on unzipper package
4bc98a7 
Fixes #197
Fixes #166
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
1 participant
@apupier