2

Vulnerabilities in the event-stream package as outlined here have meant that I receive the following error when trying to build my application.

error An unexpected error occurred: "https://registry.yarnpkg.com/event-stream/-/event-stream-3.3.6.tgz: Request failed \"404 Not Found\"".

After some digging, I realised that the mongo-cursor-pagination package I use had a dependency on mongodb-extended-json, which in turn depends on the malicious event-stream package.

After some more searching, it became apparent that the maintainers have updated the problematic dependency as shown by this commit.

However, the latest release v7.1.0 is from 28 June 2018 and doesn't include these changes.

Essentially, I would like my code to include the latest commit to mongo-cursor-pagination but I'm unsure how to go about achieving this.

ptk
  • 6,835
  • 14
  • 45
  • 91

3 Answers3

1

According documentation, you can set link to git repo with commit sh like this:

git+https://github.com/mixmaxhq/mongo-cursor-pagination.git#40c3f8d

https://docs.npmjs.com/cli/install

npm install private github repositories by dependency in package.json

Tirex
  • 454
  • 4
  • 7
1

You can download it directly from github like this: 

npm install https://github.com/mixmaxhq/mongo-cursor-pagination/tarball/master --save

if you ever need to do it again: https://github.com/{USER}/{REPO}/tarball/{BRANCH}

Mike
  • 587
  • 3
  • 6
0

Specifying the branch name in the Git URL instead of the commit hash should cause NPM to take the latest from that branch. For example, to get the latest from master:

git+https://github.com/mixmaxhq/mongo-cursor-pagination.git#master

neilthom
  • 475
  • 1
  • 4
  • 9