npm audit reports vulnerability about https-proxy-agent

[yhatt]

[email protected] has reported vulnerability of https-proxy-agent deep dependency by running npm audit (or yarn audit).
https://npmjs.com/advisories/1184

$ npm audit
                                                                                
                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Machine-In-The-Middle                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ https-proxy-agent                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.0.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ codecov [dev]                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ codecov > teeny-request > https-proxy-agent                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1184                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 high severity vulnerability in 21 scanned packages
  1 vulnerability requires manual review. See the full report for details.

codecov-node is using teeny-request v3 but the latest is v5.3.0, has included the patched https-proxy-agent v3.0.0.

[yhatt]

Now the patched https-proxy-agent >= v2.2.3 looks like available.

[xurei]

Why is this closed ? The issue is still there.

[yhatt]

@xurei This is no longer reproduced in both of my environment and a clean project (npm i --save-dev codecov && npm audit).

Probably you may have not been updated deep dependency. Try running npm --depth 3 update https-proxy-agent in your project to fix.