@types/swagger-express-mw vulnerabilities

[sandhuharjodh]

Anyone have an idea when these vulnerabilities can be fixed for package???

Introduced through: swagger-express-mw@0.7.0 › swagger-node-runner@0.7.3 › lodash@3.10.1
Introduced through: swagger-express-mw@0.7.0 › swagger-node-runner@0.7.3 › bagpipes@0.1.2 › lodash@3.10.1
Introduced through: swagger-express-mw@0.7.0 › swagger-node-runner@0.7.3 › bagpipes@0.1.2 › machinepack-http@2.4.0 › lodash@3.10.1

Introduced through: swagger-express-mw@0.7.0 › swagger-node-runner@0.7.3 › bagpipes@0.1.2 › machinepack-http@2.4.0 › machine@10.4.0 › lodash@3.10.1
Introduced through: swagger-express-mw@0.7.0 › swagger-node-runner@0.7.3 › bagpipes@0.1.2 › machinepack-http@2.4.0 › machinepack-urls@4.1.0 › lodash@3.10.1
Introduced through: swagger-express-mw@0.7.0 › swagger-node-runner@0.7.3 › bagpipes@0.1.2 › machinepack-http@2.4.0 › machine@10.4.0 › rttc@7.4.0 › lodash@3.10.1

Introduced through: swagger-express-mw@0.7.0 › swagger-node-runner@0.7.3 › bagpipes@0.1.2 › machinepack-http@2.4.0 › machinepack-urls@4.1.0 › machine@9.1.2 › lodash@3.10.1
Introduced through: swagger-express-mw@0.7.0 › swagger-node-runner@0.7.3 › bagpipes@0.1.2 › machinepack-http@2.4.0 › machinepack-urls@4.1.0 › machine@9.1.2 › rttc@4.5.2 › lodash@3.10.1
Introduced through: swagger-express-mw@0.7.0 › swagger-node-runner@0.7.3 › bagpipes@0.1.2 › machinepack-http@2.4.0 › machinepack-urls@4.1.0 › machine@9.1.2 › switchback@1.1.3 › lodash@2.4.2

[danielwhatmuff]

+1

[sandhuharjodh]

Any updates?

[plaa]

As this package and swagger-node-runner seem to be abandoned, I created forked versions of swagger-express-mw, swapper-node-runner and bagpipes which fix all but one minor vulnerability (blocked by #137). I don't plan on maintaining them other than possible occasional lib updates.

You can use patched libs you need by:

"swagger-express-mw": "Vincit/swagger-express#026b9527ebb8402db20bc479ed21e4047f1c45ba",
"swagger-node-runner": "Vincit/swagger-node-runner#427d0a4c43599de4aa03e2b3a359847b1b75cf84"
"bagpipes": "Vincit/bagpipes#b2eb059ba6f87c9185a83646fe5bac48288ccea4",

(I always recommend using commit-id locked versions when referring directly to Github repositories.)