How to properly update mem package within package-lock.json file

user_957186 0
Viewed 1351

I'm running npm version 6.1.0 There is is a package called mem within my package-lock.json file, which is not a part of my package.json file. It is at version 1.1.0. Unfortunately GitHub does not like it. Github quotes:

In nodejs-mem before version 4.0.0 there is a memory leak due to old results not being removed from the cache despite reaching maxAge. Exploitation of this can lead to exhaustion of memory and subsequent denial of service.

From the terminal what is the proper way to update this specific mem package so that my package-lock.json reflects it correctly.

npm git
1 Answers

You have to be careful, some of your dependencies are using this package. If you update mem manually some of your dependencies could break. As you pointed out that GitHub found a vulnerability you could try to run npm audit fix (NPMs automatically vulnerability fixes).

GitHub also features automatic security patches

You can also find out which package is using mem by running npm ls mem. Then update the top-level package by npm update <package>

If all of that doesn't help, I wouldn't recommend updating it manually. It could break more than it fixes.

user_105883760
Related