Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update request dependency #62

Open
onury opened this issue Jul 22, 2019 · 2 comments · May be fixed by #64
Open

Update request dependency #62

onury opened this issue Jul 22, 2019 · 2 comments · May be fixed by #64

Comments

@onury
Copy link

onury commented Jul 22, 2019

NPM warnings when iyzipay is installed for a project:

npm WARN deprecated [email protected]: ReDoS vulnerability parsing Set-Cookie https://nodesecurity.io/advisories/130
npm WARN deprecated [email protected]: Use uuid module instead
npm WARN deprecated [email protected]: This version is no longer maintained. Please upgrade to the latest version.
npm WARN deprecated [email protected]: This version is no longer maintained. Please upgrade to the latest version.
npm WARN deprecated [email protected]: This version is no longer maintained. Please upgrade to the latest version.

Most of these issues below are addressed in latest version of request (as of July 2019).
@onury onury linked a pull request Jul 22, 2019 that will close this issue
Open
@nb256
Copy link

nb256 commented Feb 10, 2020

2 high severity vulnerabilities exist on current dependencies and they can be seen on npm audit logs:

Regular Expression Denial of Service
tough-cookie
https://www.npmjs.com/advisories/525

Insufficient Entropy
cryptiles
https://www.npmjs.com/advisories/1464

@mertssmnoglu
Copy link

Request package is deprecated and have many vulnerabilities. iyzipay-node package is a payment library that should focus on the security. You should migrate to another web-http library/framework.

@mertssmnoglu mertssmnoglu mentioned this issue Feb 7, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix deps and buffer onury/iyzipay-node
3 participants
@onury @nb256 @mertssmnoglu