Alpine/npm: critical 9.8
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the
Action: Upgrade npm to 8.1.4-r0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.0.0 | 8.1.4-r0 | - |
Fixed versions
| 8.1.4-r0 |
Sources
published · modified · JSON