Our (Slate's) security scanner has been flagging the following dependency chain as a critical security vulnerability:
amphora-auth@2.0.0 › passport-twitter@1.0.4 › xtraverse@0.1.0 › xmldom@0.1.31
This is due to a CVE:
Improper Input Validation
↳ xmldom@0.1.31
passport-twitter hasn't been updated in two years and isn't used by Slate or NYMag as an auth strategy for Clay login. Let's remove it and bump the major version. I spoke to James about a larger refactor that would involve passing auth in at the instance level and will create a separate ticket for that.
Our (Slate's) security scanner has been flagging the following dependency chain as a critical security vulnerability:
This is due to a CVE:
passport-twitterhasn't been updated in two years and isn't used by Slate or NYMag as an auth strategy for Clay login. Let's remove it and bump the major version. I spoke to James about a larger refactor that would involve passing auth in at the instance level and will create a separate ticket for that.