Skip to content

Fix postman-request version#269

Merged
aviadhahami merged 3 commits intonodevault:masterfrom
SierraNL:fix-postman-request-version
Mar 10, 2026
Merged

Fix postman-request version#269
aviadhahami merged 3 commits intonodevault:masterfrom
SierraNL:fix-postman-request-version

Conversation

@SierraNL
Copy link
Contributor

@SierraNL SierraNL commented Nov 3, 2025

This fixes #268 by removing the range selector from the package files.

^ syntax does not work correctly in all cases for prerelease packages
Fix version in lockfile
@aviadhahami
Copy link
Collaborator

@SierraNL do we still need this after #273 was merged?

@SierraNL SierraNL closed this Mar 10, 2026
@SierraNL SierraNL deleted the fix-postman-request-version branch March 10, 2026 11:31
@SierraNL SierraNL restored the fix-postman-request-version branch March 10, 2026 11:32
@SierraNL
Copy link
Contributor Author

SierraNL commented Mar 10, 2026

I read to quickly, should not have closed it. So I merged the incoming changes, and my PR is correct again.

The thing with this package is the odd/crappy versioning strategy: 2.88.1-postman.48
So it's all 2.88.1 preview packages, but the preview part -postman.48 does matter here, you don't want < .42 because of the vulnerability. But you can't rely on the ^range operator here, because that only works for the major,minor,patch part of the semver. Not having a range operator makes sure you use this non vulnerable version.

This change can be reverted again when a 2.88.2 or higher has been released.

@SierraNL SierraNL reopened this Mar 10, 2026
@aviadhahami aviadhahami self-assigned this Mar 10, 2026
@aviadhahami
Copy link
Collaborator

@SierraNL fair enough

That said -> maybe it's time to get rid of it altogether
Mind taking a look at swapping this lib for a better one? (needle? not sure)

@aviadhahami aviadhahami added this pull request to the merge queue Mar 10, 2026
Merged via the queue into nodevault:master with commit cef266a Mar 10, 2026
8 checks passed
@SierraNL
Copy link
Contributor Author

@SierraNL fair enough

That said -> maybe it's time to get rid of it altogether Mind taking a look at swapping this lib for a better one? (needle? not sure)

I'm really not familiar in the javascript world, I don't even know that the library does. I made this PR because I was helping a team at work that was trying to solve a vulnerability. No I can't help you out there.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Dependency postman-request with odd versioning causes issues with npm's before

2 participants