ssri

[id2359]

ssri
Open GitHub opened this alert 2 days ago
Dependabot cannot update ssri to a non-vulnerable version
The latest possible version that can be installed is 6.0.1 because of the following conflicting dependencies:

react-scripts@3.4.0 requires ssri@^7.0.0 via a transitive dependency on cacache@13.0.1
react-scripts@3.4.0 requires ssri@^6.0.1 via a transitive dependency on cacache@12.0.3
The earliest fixed version is 8.0.1.

View logs or learn more about troubleshooting Dependabot errors.

1 ssri vulnerability found in …/frontend/yarn.lock 2 days ago
Remediation
Upgrade ssri to version 8.0.1 or later. For example:

ssri@^8.0.1:
version "8.0.1"

[APMCCG]

Currently unable to upgrade: latest version of react-scripts does not yet address the security issues (facebook/create-react-app#10698).

[APMCCG]

After upgrading react-scripts to latest version (#1738), cacache dependencies have been updated from 13.0.1 to 15.0.6 in the terser-webpack-plugin dependency and from 12.0.3 to 12.0.4 in the webpack dependency. Security issue has been addressed, refer to https://github.com/npm/cacache for more information.