Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.In rc-1, as well as in rc-3, there are 10 security alerts as found by GitHub in package-lock.json. All that is being suggested is to increase the dependency versions to ones that have been patched against several security vulnerabilities. See attached screenshot for details.
| Comment | File | Size | Author |
|---|---|---|---|
| Screen Shot 2020-01-27 at 8.47.21 AM.png | 115 KB | iankmcilwraith |
Comments
Comment #3
jfeltkampThe the package.json, package-lock.json and webpack.config.js are just for maintaining the module and not for custom use.
But ok. I removed the package-lock.json and set it in .gitignore.
Fixed in 8.x-1.x and will be part of next RC.
Comment #4
jfeltkamp