Security issues with outdated dependency

[franher]

Description/Steps to reproduce

There is a security vulnerability in "strong-globalize": "^3.1.0" (see Prototype Pollution for more details).

To reproduce it set up a project with latest loopback-connector-mongodb (v3.4.3) as dependency and run nspover it:

$> npm init
$> npm i --save loopback-connector-mongodb
$> npx nsp -- check

The vulnerability comes from [email protected] > [email protected] > [email protected] > [email protected] . All the related packages with the issue have release a version fixing the vulnerability:

• npm6 vulnerability unclechu/node-deep-extend#41
• Prototype Pollution Vulnerability swagger-api/swagger-js#1304
• Security issues with outdated dependency IBM-Cloud/gp-js-client#121

[email protected] is released few days ago, so updating it here would fix the issue.

Link to reproduction sandbox

Not apply for this issue.

Expected result

Not security vulnerabilities after running nsp or npm audit.

Additional information

• Result of node -e 'console.log(process.platform, process.arch, process.versions.node)'

darwin x64 8.11.2

• Result of npm ls --prod --depth 0 | grep loopback

├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]

[virkt25]

@franher Can you please try this again -- npm i for me installs [email protected] which is not vulnerable. nsp comes clean for me.

[franher]

@virkt25 You're right. Now, installing loopback-connector-mongodb v3.4.3 and v3.4.4 the security issue is out.

Thank you for your time.