[BUG] NPM vulnerabilities

[ofirrifo]

I start to get vulnerabilities for this package.
I try to run the npm update hosted-git-info --depth 13 but is say ->
not updating hosted-git-info because it's currently at the maximum version that matches its specified semver range

Run npm update hosted-git-info --depth 13 to resolve 104 vulnerabilities

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Regular Expression Denial of Service │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ hosted-git-info │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ stylelint │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ stylelint > meow > read-pkg-up > read-pkg > │
│ │ normalize-package-data > hosted-git-info │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/1677 │
└───────────────┴──────────────────────────────────────────────────────────────┘

[bobvandevijver]

See #85, the vulnerability database has just been updated.

[ofirrifo]

@bobvandevijver
I executed the npm update hosted-git-info --depth 13
and then I execute npm audit and I still get the vulnerabilities for hosted-git-info

[bobvandevijver]

Than you have probably have a constraint somewhere as version 2, 3 and 4 have patches. You should create an issue at the package that still requires version 1.

[wraithgar]

The latest version of this module has no current audit warnings

$ npm audit --omit=dev
found 0 vulnerabilities