#3093 'Got' dependency has security issue (dependabot)

[Anonymous]

Originally created by: keean

Library Affected:
workbox-cli@6.5.3 (npm)

Browser & Platform:
All

Issue or Feature Request Description:
Dependabot is reporting the following alert for a dependency of workbox-cli:

'got' (npm) allows a redirect to a UNIX socket

This is the dependency tree for this package:

workbox-cli@6.5.3
update-notifier@4.1.3
latest-version@5.1.0
package-json@6.5.0
got@9.6.0

The earliest fixed version is got@11.8.5

[Anonymous]

Originally posted by: marang

please fix / bump versions

[Anonymous]

Originally posted by: tomayac

Hi there,

Workbox is moving to a new engineering team within Google. As part of this move, we're declaring a partial bug bankruptcy to allow the new team to start fresh. We realize this isn't optimal, but realistically, this is the only way we see it working. For transparency, here're the criteria we applied:

• For PRs, we closed everything that doesn't target the current v7 branch.
• For Issues, we closed everything that was created before 2024.

Thanks, and we hope for your understanding!
The Workbox team

[Anonymous]

Ticket changed by: tomayac

• status: open --> closed