Cli: [QUESTION] Possible to fix vulnerability issue related to dot-prop?

[ziale]

What / Why

Anchore is reporting a vulnerability issue that is related to an old(<5.1.1) version of the dot-prop package.

I tried to trace the versions:
update-notifier depends on configstore which depends on dot-prop.

[email protected] uses [email protected] which uses [email protected] where the issue has been fixed.

Is it possible to fix this?

[ljharb]

You'd have to file that on configstore's repo, and then on update-notifier's repo.

[ziale]

You'd have to file that on configstore's repo, and then on update-notifier's repo.

This repo is using update-notifier 2.5.0, and 4.1.0 would fix the issues. The other repos mentioned already using the fixed versions.