Security vulnerability due to outdated nested dependency (dot-prop)

[marian-r]

npm audit output:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ dot-prop                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ clinic [dev]                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ clinic > insight > conf > dot-prop                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1213                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

[mcollina]

There is nothing to worry about this, hopefully it would be fixed soon.

[marian-r]

@mcollina the vulnerability has been fixed, just a direct dependency (insight) is using an unpatched version of the vulnerable package. Do we just have to wait until "insight" upgrades its dependency?

[mcollina]

that's the plan, yes

[marian-r]

I've opened an issue for that too sindresorhus/insight#71. Let's hope it won't take long, although I'm a bit fearful it's gonna take a while as that package hasn't seen an update for over a year 😟

[mcollina]

There is literally nothing to worry about that vulnerability, you are safe.