Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security scan warnings #257

Closed
sv3k opened this issue Aug 21, 2019 · 0 comments
Closed

Security scan warnings #257

sv3k opened this issue Aug 21, 2019 · 0 comments

Comments

@sv3k
Copy link

sv3k commented Aug 21, 2019

We are using WhiteSource to scan our projects for security issues. It basically does npm install and scans every file it got (including dependencies) for security risks. Since we're using sockjs, we have the following warning:
.../node_modules/sockjs/examples/echo/index.html uses jquery-1.7.1

So all the sockjs examples are using an old version of jquery with security vulnerabilities, and all those examples are bundled in the distributed package.

I know it's kinda false positive since it shouldn't go to production code, but for such a popular library it should be important enough.

I'd suggest to either add examples folder to .npmignore (will save the library users traffic as well), or update jQuery in these examples, or both.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant