CODEWITHSUNDEEP
gitnpm
klewis
klewis

Reputation: 8350

How to properly update mem package within package-lock.json file

I'm running npm version 6.1.0 There is is a package called mem within my package-lock.json file, which is not a part of my package.json file. It is at version 1.1.0. Unfortunately GitHub does not like it. Github quotes:

In nodejs-mem before version 4.0.0 there is a memory leak due to old results not being removed from the cache despite reaching maxAge. Exploitation of this can lead to exhaustion of memory and subsequent denial of service.

From the terminal what is the proper way to update this specific mem package so that my package-lock.json reflects it correctly.

Upvotes: 2

Views: 1364

Answers (1)

MarvinJWendt
MarvinJWendt

Reputation: 2684

You have to be careful, some of your dependencies are using this package. If you update mem manually some of your dependencies could break. As you pointed out that GitHub found a vulnerability you could try to run npm audit fix (NPMs automatically vulnerability fixes).

GitHub also features automatic security patches

You can also find out which package is using mem by running npm ls mem. Then update the top-level package by npm update <package>

If all of that doesn't help, I wouldn't recommend updating it manually. It could break more than it fixes.

Upvotes: 5

Related Questions