[Snyk] Security upgrade bcrypt from 5.0.1 to 6.0.0#33
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-TAR-15038581 - https://snyk.io/vuln/SNYK-JS-TAR-6476909
There was a problem hiding this comment.
Pull request overview
This PR upgrades the bcrypt package from version 5.0.1 to 6.0.0 to address two medium-severity security vulnerabilities in the transitive dependency tar (SNYK-JS-TAR-15038581 and SNYK-JS-TAR-6476909). The upgrade eliminates these vulnerabilities by replacing the build system from @mapbox/node-pre-gyp to node-gyp-build, which removes the vulnerable tar dependency entirely.
Changes:
- Updated bcrypt from 5.0.1 to 6.0.0
- Replaced build system dependencies (removed @mapbox/node-pre-gyp, added node-gyp-build)
- Upgraded node-addon-api from 3.2.1 to 8.5.0
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Updates bcrypt dependency constraint to ^6.0.0 |
| package-lock.json | Reflects complete dependency tree changes including bcrypt upgrade, removal of @mapbox/node-pre-gyp and its transitive dependencies, and addition of node-gyp-build build system |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "license": "ISC", | ||
| "dependencies": { | ||
| "bcrypt": "^5.0.1", | ||
| "bcrypt": "^6.0.0", |
There was a problem hiding this comment.
The bcrypt version constraint uses the caret (^) range operator with "^6.0.0", which will allow automatic updates to any 6.x.x version. While this follows semantic versioning, be aware that this major version upgrade includes significant changes (new build system, higher Node.js requirement). Consider whether you want to lock to a specific version temporarily (e.g., "6.0.0") until the upgrade is thoroughly tested in your environment.
| "bcrypt": "^6.0.0", | |
| "bcrypt": "6.0.0", |
Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
package.jsonpackage-lock.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-TAR-15038581
SNYK-JS-TAR-6476909
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Uncontrolled Resource Consumption ('Resource Exhaustion')