Backport the recent security fix to 3.x about simple-get HOT 8 CLOSED

That would be great because simple-get ^3.0.3 is a transitive dependency of other packages, like prebuild-install v5 and v6.

from simple-get.

@LinusU I gave you access to this package on GitHub and npm to help handle these security fixes. Appreciate it!

from simple-get.

I've cherry-picked the fix and released 3.1.1 and 2.8.2 🚀

from simple-get.

I've cherry-picked the fix and released 3.1.1 and 3.8.2 🚀

Amazing, thanks.

For the record: the last version number is a typo and needs to be 2.8.2. See also versions tab in https://www.npmjs.com/package/simple-get.

from simple-get.

Looks like there is a backport for 2.x.x in PR #75 , I would surmise a fix here would be very similar. I hope we get some traction here.

from simple-get.

I think that you can already make your pull request @LinusU, so that feross just have to approve and merge the stuff.

from simple-get.

Thanks! Somebody has poked the powers that be so GHSA-wpg7-2c88-r8xv get updated with the new fixed versions?

from simple-get.

Unfortunately I have no idea how to do that, would love to get to know how though ☺️

from simple-get.