Current version of the levelup dependency for this project has a known security vulnerability about browserify-fs HOT 12 OPEN

Is this something you expect you might have an ETA for a fix for or is the project abandoned?

from browserify-fs.

so the actual issue is about updating levelup to version 2.0.0, a pull request doing so and making sure the tests pass would go a long way to helping this be resolved

from browserify-fs.

actually I take it back, updating it to 0.19.1 would probably do the trick

from browserify-fs.

Updating [email protected] will fix CVE-2015-8855 (patched in semver@>=4.3.2) but not Memory exposure in bl (patched in bl@>=0.9.5 <1.0.0 || >=1.0.1).

levelup@>=1.0.0 Is without any issues.

from browserify-fs.

I've got the same security notification

└─┬ [email protected]
  └─┬ [email protected]
    └─┬ [email protected]
      └── [email protected]

from browserify-fs.

Any progress on this?

from browserify-fs.

Ping @mafintosh: will you consider the #15 PR, so we can get the ball rolling on fixing the security warnings in people's repositories?

from browserify-fs.

from browserify-fs.

If it's just a question of pulling for this update and possibly any future such ones (at least clear-cut ones like this), I could sign on (brettz9 on npm as well).

from browserify-fs.

Another issue that someone can hopefully address is that the current version of the dependency level-filesystem (1.2.0) has an outdated dependency chain of level-sublevel (5.2.3) -> xtend (2.0.6) -> object-keys (version 0.2.0, a deprecated version); see mafintosh/level-filesystem#9

from browserify-fs.

Any updates with this?

from browserify-fs.

Ping @mafintosh: will you consider the #15 PR, so we can get the ball rolling on fixing the security warnings in people's repositories?

@mroderick I just made another PR (#24) with main differences being compared to #15 are that it is ready and it does not require browser testing/karma instead it uses spec compliant fake-indexeddb mock inside node/jest environment. I did not upgrade any dependencies but it can still be used as solid base for future security fixes.

/cc @mafintosh

from browserify-fs.