Skip to content

cross-spawn vulnerability GHSA-3xgq-45jj-v275 #23

@t-ricci-avatarux

Description

@t-ricci-avatarux

bin-build uses an old version of execa (^0.7.0) which depends on an old version of cross-spawn (^5.0.1) which is vulnerable (see this link https://osv.dev/vulnerability/GHSA-3xgq-45jj-v275)

In order to fix the vulnerability issue it would be enough to bump execa to version ^2.1.0 which depends on cross-spawn ^7.0.0 (which includes the vulnerability patch in version 7.0.5)

@kevva would you be able to take a look at it and see if you can bump the package and release an update of bin-build?

Thank you

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions