Kevin

1. Get notified by a low severity CVE in a bundled dependency in npm
2. Receive an MR to update npm
3. MR gets merged
4. Day later, get notified about a high severity CVE in a bundled dependency in updated version of npm

🤦

#AlpineSecurity

Nov 18 at 2:18pmWeb
Show threadKevinNov 18

To be fair, the 2nd CVE was also present in the previous version, so the upgrade did not introduce it.

The bad part is that it hasn't been fixed upstream yet. Even master still bundles the vulnerable dependency.