Security vulnerability

Question

Chunkygoo · Answer

https github com supertokens supertokens node issues 461

nkshah2 · Answer

Thanks well take a look

Chunkygoo · Answer

< rp>

Chunkygoo · Answer

Can you clarify what you mean The fix to this involves updating jsonwebtoken to 9 0 0 which doesn t support versions of node below 11 This would have been fine except that we are not using the verify function from jsonwebtoken package

rp · Answer

It means we will not update the dependency of that library Cause the function that s vulnerable isn t used by us anyway

rp · Answer

So the vulnerability pointed out by npm run audit doesnt apply to us

Chunkygoo · Answer

So the vulnerability isn t really a vulnerability

Chunkygoo · Answer

And the reason to not update the dependency is because updating it would discontinue the support for node versions below 11

rp · Answer

Yes Correct