extract-zip has a dependency to mkdir@0.5.2, that has a dependency to minimist@0.0.8 which has a security issue

[andreasmarkussen]

Chromedriver depends on extract-zip@1.6.7, which has a security problem.

Extract-zip has a dependency on mkdir@0.5.2, that has a dependency on minimist@0.0.8 which has a security issue

The problem is not easy to fix since extract-zip is not maintained.

The fix should be that someone should take over extract-zip and ensure that it is up to date.

Does anyone have suggestions to how to cope with a situation like this?

[dmarczydlo]

From security reason are you planning to update minimist dependencies?

[andrewiggins]

extract-zip has been updated: max-mapper/extract-zip#88

[giggio]

I just updated and released a fix.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.