Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Any plans to fix the vulnerabilities? #23

Open
tomhalley opened this issue May 30, 2021 · 7 comments · Fixed by #25 or #26
Open

Any plans to fix the vulnerabilities? #23

tomhalley opened this issue May 30, 2021 · 7 comments · Fixed by #25 or #26

Comments

@tomhalley
Copy link

As title says - on install, this plugin adds 6 high vulnerabilities, all seeming to stem from outdated dependencies on axios, jest and serverless. Thanks

@tomhalley tomhalley changed the title Any plans to fix the vulnerabilities Any plans to fix the vulnerabilities? May 30, 2021
@Vadorequest
Copy link
Member

They're probably false-positive vulnerabilities affecting the dev dependencies. Most of the time "vulnerabilities" aren't quite a real thing.

A PR is welcome, though! :)

@Vadorequest
Copy link
Member

@tomhalley Thank you for the PR. I've merged it into #25 to try it out and upgrade other things (testing it, also).

Unfortunately, I can't really afford to spend time on this project. It's outdated, and it's not useful to use (we don't use Serverless nor DynamoDB at the company).

I'm thinking about marking the repository as read-only.

If you're (or anyone) considering forking it and updating it let me know and I'll modify the readme to let people know about the fork.

@Vadorequest
Copy link
Member

I couldn't test it without updating because the example is using node 8 which can't be used anymore, had to upgrade things, but it feels like I might spend too much time on this.

@tomhalley
Copy link
Author

I'm happy to pick it up and run with it, bring the examples up to date, but it might be better to just create a PR, merge the updates and then mark your repo as read only after. I'll create a PR for the examples in a short while.

@Vadorequest
Copy link
Member

Alright! let's do that then, I'll await for your PR before changing anything then.

@Vadorequest
Copy link
Member

I merged it, tried to release a new npm version but having access issues for some reason... contacted support.

@Vadorequest Vadorequest reopened this Jun 2, 2021
@Vadorequest
Copy link
Member

@tomhalley A new version has been released. https://www.npmjs.com/package/@unly/serverless-plugin-dynamodb-backups/v/2.0.0-alpha1 2.0.0-alpha1. Could you try it out and let me know if it works alright for you? 😄

I'll release it as a proper version once I get some confirmation there is no regression. I don't have any real-world project to test it on myself.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants