Sitelet https://github.com/dvajs/dva/issues/2524
Skip to content

存在漏洞依赖 node-fetch #2524

Description

@ganyanchuan1989

What happens?

npm audit 检查 dva 存在安全漏洞。已经更新最新版本的dva@2.4.1 ,问题依旧存在。以下是执行 npm audit 输出的漏洞信息:

                                 Manual Review
             Some vulnerabilities require your attention to resolve

          Visit https://go.npm.me/audit-guide for additional guidance

 High            node-fetch forwards secure headers to untrusted sites

  Package         node-fetch

  Patched in      >=2.6.7

  Dependency of   dva

  Path            dva > isomorphic-fetch > node-fetch

  More info       https://github.com/advisories/GHSA-r683-j2x4-v87g

isomorphic-fetch 在最新版本已经更新了不存在漏洞的node-fetch的版本,请dva也同步更新一下 isomorphic-fetch 版本。

复现步骤,错误日志以及相关配置

相关环境信息

"dva": "^2.4.1",

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions