[GitHub] [cordova-cli] plasticlobster commented on issue #610: Cordova has dependencies which use deprecated libraries

["plasticlobster (via GitHub)" <gi...@apache.org>]

plasticlobster commented on issue #610:
URL: https://github.com/apache/cordova-cli/issues/610#issuecomment-1686696956

   The `insight` dependency that may have been "just warnings" back in May now has a CVE attached to it, as the `request` package is no longer supported by the maintainer and will not be updated to patch its associated security issue.
   CVE-2023-28155
   
   While the pacote dependency cleanup in Cordova 12.0.0 does address one path of requiring `request`, the other path through `insight` is still very much an issue.
   
   `insight` also seems to be a dead project with no updates since 2021.
   
   I have no delved into why Cordova needs `insight`, but it seems like now might be a good time to strip that dependency.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org