Update package-lock.json file to automatically remove the vulnerability #16
Description
Hi, @ismail-codinglab @issy321, I have reported a vulnerability issue in package google-p12-pem.
As far as I am aware, vulnerability(high severity) CVE-2020-7720 detected in package node-forge<0.10.0 is directly referenced by google-p12-pem@2.0.4, on which your package gmail-inbox@1.5.0 transitively depends. As such, this vulnerability can also affect gmail-inbox@1.5.0 via the following path:
gmail-inbox@1.5.0 ➔ google-auth-library@5.10.1 ➔ gtoken@4.1.4 ➔ google-p12-pem@2.0.4 ➔ node-forge@0.9.2(vulnerable version)
Since google-p12-pem has released a new patched version google-p12-pem@2.0.5 to resolve this issue (google-p12-pem@2.0.5 ➔ node-forge@0.10.0(fix version)), then this vulnerability patch can be automatically propagated into your project only if you update your package-lock.json file (delete package-lock.json and re-execute npm install command):
gmail-inbox@1.5.0 ➔ google-auth-library@5.10.1 ➔ gtoken@4.1.4 ➔ google-p12-pem@2.0.5 ➔ node-forge@0.10.0(vulnerability fix version).
A warm tip.^_^