-
Notifications
You must be signed in to change notification settings - Fork 5
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Any plans to fix the vulnerabilities? #23
Comments
They're probably false-positive vulnerabilities affecting the dev dependencies. Most of the time "vulnerabilities" aren't quite a real thing. A PR is welcome, though! :) |
@tomhalley Thank you for the PR. I've merged it into #25 to try it out and upgrade other things (testing it, also). Unfortunately, I can't really afford to spend time on this project. It's outdated, and it's not useful to use (we don't use Serverless nor DynamoDB at the company). I'm thinking about marking the repository as read-only. If you're (or anyone) considering forking it and updating it let me know and I'll modify the readme to let people know about the fork. |
I couldn't test it without updating because the example is using node 8 which can't be used anymore, had to upgrade things, but it feels like I might spend too much time on this. |
I'm happy to pick it up and run with it, bring the examples up to date, but it might be better to just create a PR, merge the updates and then mark your repo as read only after. I'll create a PR for the examples in a short while. |
Alright! let's do that then, I'll await for your PR before changing anything then. |
I merged it, tried to release a new npm version but having access issues for some reason... contacted support. |
@tomhalley A new version has been released. https://www.npmjs.com/package/@unly/serverless-plugin-dynamodb-backups/v/2.0.0-alpha1 I'll release it as a proper version once I get some confirmation there is no regression. I don't have any real-world project to test it on myself. |
As title says - on install, this plugin adds 6 high vulnerabilities, all seeming to stem from outdated dependencies on axios, jest and serverless. Thanks
The text was updated successfully, but these errors were encountered: