Skip to content

Dependency on outdated version of glob #2454

@ej612

Description

@ej612

Hi there!

Our organization's Black Duck has started flagging alasql for its dependency on glob v7, which is severely outdated, with the most recent major being v13.

I see there's an open PR to update to the most recent version, is there a chance to get that in?
#2439

Thank you very much in advance and keep up the good work!

Edit: I just took a look at your package.json and you actually have an override for glob@13 in there. However, in my project, alasql pulls in glob@7:

    "node_modules/alasql/node_modules/glob": {
      "version": "7.2.3",

And I'm getting warnings when installing:

npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me

I'll do some further digging to find out where that dependency comes from and report back.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions