Repository navigation
qs package security flaw #3230
Description
https://snyk.io/vuln/npm:qs:20170213
Seems like express is locked to 6.2.0, can this be bumped to 6.2.2?
{{ message }}
https://snyk.io/vuln/npm:qs:20170213
Seems like express is locked to 6.2.0, can this be bumped to 6.2.2?
Activity
dougwilson commentedon Mar 1, 2017
I am a bit disappointed you didn't follow the instructions for disclosing security issues...
[-]qs package security flaw[/-][+]aaaa[/+]dougwilson commentedon Mar 1, 2017
For anyone wondering, this is a vulun that affects an underlying module, but a feature that Express does not use of the module. The module is going to be upgraded in a version of Express released today, but previous versions are not affects by the issue, since it's not a feature Express uses.
[-]aaaa[/-][+]qs package security flaw[/+]dougwilson commentedon Mar 1, 2017
Hi @karlatkinson I have restored the original issue report now that Express 4.15.0 has been released with an updated
qsmodule.karlatkinson commentedon Mar 2, 2017
Thanks @dougwilson. 👍
I would have raised it via a private channel if it wasn't already in the public domain. Will follow your process going forward however.
I'd highly recommend integrating snyk into your workflow to get automatic notifications in the future.
dougwilson commentedon Mar 2, 2017
Snyk is already part of the workflow. They did not publish the notice until yesterday, so I had no lead time to do anything.
Remove direct `qs` dependency
Remove direct `qs` dependency
Remove direct `qs` dependency
Remove direct `qs` dependency