javascript - node-sass fstream 和 tar 依赖项漏洞

Question

这是我在 package-lock.json 中的 node-gyp 依赖项

"node-gyp": {
      "version": "3.8.0",
      "resolved": "http://nexus.prod-admin11.vip.aws1/nexus/content/groups/npm-edmunds/node-gyp/-/node-gyp-3.8.0.tgz",
      "integrity": "sha512-3g8lYefrRRzvGeSowdJKAKyks8oUpLEd/DyPV4eMhVlhJ0aNaZqIrNUIPuEWWTAoPqyFkfGrM67MC69baqn6vA==",
      "dev": true,
      "requires": {
        "fstream": "^1.0.0",
        "glob": "^7.0.3",
        "graceful-fs": "^4.1.2",
        "mkdirp": "^0.5.0",
        "nopt": "2 || 3",
        "npmlog": "0 || 1 || 2 || 3 || 4",
        "osenv": "0",
        "request": "^2.87.0",
        "rimraf": "2",
        "semver": "~5.3.0",
        "tar": "^2.0.0",
        "which": "1"
      },
      "dependencies": {
        "semver": {
          "version": "5.3.0",
          "resolved": "http://nexus.prod-admin11.vip.aws1/nexus/content/groups/npm-edmunds/semver/-/semver-5.3.0.tgz",
          "integrity": "sha1-myzl094C0XxgEq0yaqa00M9U+U8=",
          "dev": true
        }
      }
    },

当我在此包中运行 yarn 审计时，我遇到了很高的漏洞:

node-sass > node-gyp > tar

node-sass > node-gyp > tar > fstream

node-sass > node-gyp > fstream

Answer 1

这两个漏洞均已在次要版本中修复。如果您想获取最新版本的依赖项，您可能需要删除锁定文件并重新安装。