Quirrel Outdated Packages

[m1daz]

I would love to use quirrel due to its self-hosted solutions, but quirrel seems to add atleast 3 npm security vulnerabilities, and when updating to the most recent version, about 5 (some high severity). Will the dependencies for quirrel be updated ever?

[Skn0tt]

Quirrel dependencies are updated once in a while. I'm assuming that you're referring at the output of npm audit. I took a look at npm audit, and of the listed "high severity" vulnerabilities, none are actually vulnerable in the way how Quirrel uses them. Here's a good piece by Dan Abramov on why npm audit is flawed: https://overreacted.io/npm-audit-broken-by-design/

Having said that, you're very welcome to provide pull requests with dependency updates.

[m1daz]

Quirrel dependencies are updated once in a while. I'm assuming that you're referring at the output of npm audit. I took a look at npm audit, and of the listed "high severity" vulnerabilities, none are actually vulnerable in the way how Quirrel uses them. Here's a good piece by Dan Abramov on why npm audit is flawed: https://overreacted.io/npm-audit-broken-by-design/

Having said that, you're very welcome to provide pull requests with dependency updates.

Oh thank you so much. I was unaware and just wanted to make sure because the application stores sensitive information.

Once again, thank you!