Skip to content

Conversation

@smolnikov
Copy link

@smolnikov smolnikov commented Nov 25, 2025

This PR:

  • ✅ removes the dependency on package koa-proxy which didn't have updates for 6 years now and introduces critical security vulnerabilities; replaces it with custom-made axios-based implementation of proxy
  • ✅ updates other dependencies introducing vulnerabilities detected by npm audit
  • resolves Outdated packages like @oclif/*, cli-ux, koa-proxy, and some more #33
  • ❌ doesn't update the supported engine in package.json (to >=18 as many dependencies in package-lock.json already have it set, so current version doesn't truly support node 16) as this will require major version update

How it was tested:

  • npm run build && npm run test

@smolnikov smolnikov force-pushed the fix-critical-vulnerabilities branch from df51c3c to 46ba398 Compare November 25, 2025 10:41
@smolnikov
Copy link
Author

@anttiviljami could you share your opinion on this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Outdated packages like @oclif/*, cli-ux, koa-proxy, and some more

1 participant