Patch for XLSX vulnerability - #1371
Conversation
|
LGTM |
|
For anybody interested, here's some context on why this PR needs to exist in the first place: A while back, the maintainers of XSLX (a dependency of this package) decided to stop publishing to NPM because NPM started requiring 2-Factor Authentication. Nobody really quite understands why this is such a big issue, but regardless, the maintainers of the package are essentially boycotting NPM and distributing the package themselves. Many people are very unhappy about this, as can be expected, for a host of reasons, one of which being a critical vulnerability (a Denial of Service, if I'm not mistaken) in the XLSX package, which will now never get patched. Thus, various people in the NPM community took it upon themselves to publish up-to-date versions of XSLX (like the one used in this PR). This PR will get rid of the critical vulnerabilities you see when you install node-nlp. |
|
Thats kind of what I also found in short check . Thank you for providing this background |
|
I incorprate this into #1376 ... there was more to be done then just changing the dependency |
Pull Request Template
PR Checklist
npm testlocally and all tests are passing.PR Description
A patch for an underlying vulnerability in
XLSX, which is a dependency of the@node-nlp/xtablespackage. This PR uses a patched version ofXLSX, thus removing the vulnerability.