To bump `pug` to latest >3.x.x
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- javascript, pug
Research direction
Start at bin/express-cli.js around line 307 and inspect where the pug dependency is declared. Update it from the vulnerable v2-beta range to the latest v3 release, then verify that the generator still runs and no longer installs the vulnerable version.
Written by the indexing model from the issue text.
Description
pug it's already in v3 since a few months ago. Some vulnerability issues are coming with the v2-beta version: https://github.com/oscard0m/express-boilerplate/pull/1
Is there any blocker to update this?
https://github.com/expressjs/generator/blob/d1f3fcc6ccc7ab8986fb3438c82ab1a1f20dc50d/bin/express-cli.js#L307
- Dominant language
- JavaScript
- Stars
- 1.9k
- Forks
- 548
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from expressjs/generator
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
question
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 45/100
-
tests
Difficulty 3/5 1-2 days Newbie friendliness 45/100
All issues in expressjs/generator
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
HarperFast/skills#96 ·
-
[Block] Latest Posts [Type] Bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
sugarlabs/musicblocks#8847 ·