Outdated dependencies causes 'vulnerabilities found' warnings

[stephanvane]

This project depends on the bin-wrapper package. Unfortunately this package hasn't had any new versions for 4 years.

Bin-wrapper eventually relies on outdated versions of packages (got and semver-regex), causing npm to complain about vulnerable packages.

3 vulnerabilities found
Severity: 1 low | 1 moderate | 1 high

Is there a way to stop relying on bin-wrapper? The package only seems +- 200 lines long anyway :)

[waiyan13]

I encountered this as well.

# npm audit report

got  <11.8.5
Severity: moderate
Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97
fix available via `npm audit fix --force`
Will install @swc/cli@0.1.57, which is a breaking change
node_modules/got
  download  >=4.0.0
  Depends on vulnerable versions of got
  node_modules/download
    bin-wrapper  >=0.4.0
    Depends on vulnerable versions of bin-version-check
    Depends on vulnerable versions of download
    node_modules/bin-wrapper
      @swc/cli  >=0.1.58
      Depends on vulnerable versions of bin-wrapper
      node_modules/@swc/cli

semver-regex  <=3.1.3
Severity: high
Regular Expression Denial of Service (ReDOS) - https://github.com/advisories/GHSA-44c6-4v22-4mhx
Regular expression denial of service in semver-regex - https://github.com/advisories/GHSA-4x5v-gmq8-25ch
fix available via `npm audit fix --force`
Will install @swc/cli@0.1.57, which is a breaking change
node_modules/semver-regex
  find-versions  <=3.2.0
  Depends on vulnerable versions of semver-regex
  node_modules/find-versions
    bin-version  <=4.0.0
    Depends on vulnerable versions of find-versions
    node_modules/bin-version
      bin-version-check  <=4.0.0
      Depends on vulnerable versions of bin-version
      node_modules/bin-version-check

8 vulnerabilities (3 low, 4 moderate, 1 high)

To address all issues (including breaking changes), run:
  npm audit fix --force

My @swc/cli version in package.json is ^0.1.59.

[kdy1]

cc @kwonoj

[waiyan13]

Any updates?

[brodo]

Same here. This fork seems to be actively maintained.

[kwonoj]

We'll going to look into but I'm pretty much occupied for now. If anyone's up with PR, welcome to have it meanwhile.