running npm audit on a project with lepto-cli returns a moderate security risk:
Moderate Memory Exposure
Package tunnel-agent
Patched in >=0.6.0
Dependency of lepto-cli [dev]
Path lepto-cli > lepto > pngquant > pngquant-bin > bin-wrapper >
download > caw > tunnel-agent
More info https://npmjs.com/advisories/598
I know that the warning seems to originate from the caw package that should update tunnel-agent package. But caw has not yet been updated for over 2 years, don't think it is going to happen. And I saw that gatsby package had same security notice and were able to fix it themselves, so it should be possible to apply the same method to fix this security flaw:
gatsbyjs/gatsby#7293
(Update: probably better to post this in the lepto repo, I will do that also)
running npm audit on a project with lepto-cli returns a moderate security risk:
Moderate Memory Exposure
Package tunnel-agent
Patched in >=0.6.0
Dependency of lepto-cli [dev]
Path lepto-cli > lepto > pngquant > pngquant-bin > bin-wrapper >
download > caw > tunnel-agent
More info https://npmjs.com/advisories/598
I know that the warning seems to originate from the caw package that should update tunnel-agent package. But caw has not yet been updated for over 2 years, don't think it is going to happen. And I saw that gatsby package had same security notice and were able to fix it themselves, so it should be possible to apply the same method to fix this security flaw:
gatsbyjs/gatsby#7293
(Update: probably better to post this in the lepto repo, I will do that also)