Got允许重定向到UNIX套接字

Question

# npm audit report

got  <11.8.5
Severity: moderate
Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97
fix available via `npm audit fix --force`
Will install nodemon@1.3.3, which is a breaking change
node_modules/got
  package-json  <=6.5.0
  Depends on vulnerable versions of got
  node_modules/package-json
    latest-version  0.2.0 - 5.1.0
    Depends on vulnerable versions of package-json
    node_modules/latest-version
      update-notifier  0.2.0 - 5.1.0
      Depends on vulnerable versions of latest-version
      node_modules/update-notifier
        nodemon  >=1.3.5
        Depends on vulnerable versions of update-notifier
        node_modules/nodemon

Answer 1

编辑package.json应该可以做到这一点：

1. For NPM users

“重写”：{ "got"："^12.1.0“}

1. For users

“解决方案”：{ "got"："^12.1.0“}

Answer 2

从咨询- https://github.com/advisories/GHSA-pfrx-2q88-qq97，这可能会给你一个更完整的回应。

"overrides": {
    "got@<11.8.5": "11.8.5",
    "got@>=12.0.0 <12.1.0 ": "^12.1.0"
}