NPM audit: critical vulnerability

[jlaamanen]

npm audit reports a critical vulnerability concerning open package. There seems to be no fix available in open, and it's not under active development anymore (last updated 4 years ago) and should be deprecated:
pwnall/node-open#67
pwnall/node-open#68

There is an alternative (actively maintained) package available over here: https://www.npmjs.com/package/opn. A quick search shows that there is one line of code using the open package at the moment, and needs to be changed: https://github.com/mbloch/mapshaper/blob/master/bin/mapshaper-gui#L104

[mbloch]

Thanks for the PR -- I just merged it. For the record, the reported vulnerability did not apply to mapshaper-gui, because "unsanitized user input" was not being passed to open().

[jlaamanen]

Thanks, happy to help! True that there were no real vulnerabilities, but since npm version 6 was released, npm audit is run automatically along with npm install, so in our project this dependency was listed having a critical vulnerability, so it was a bit of a nuisance... :)