chore: mitigate security advisory 886 - #198

Closed
hughrawlinson wants to merge 2 commits into
npm:latestfrom
hughrawlinson:bump-node-gyp
Closed

chore: mitigate security advisory 886#198
hughrawlinson wants to merge 2 commits into
npm:latestfrom
hughrawlinson:bump-node-gyp

Conversation

@hughrawlinson

@hughrawlinsonhughrawlinson commented May 22, 2019•
edited
Loading

Copy link
Copy Markdown

node-gyp@3.8.0 uses fstream@1.0.11, which has this advisory: https://www.npmjs.com/advisories/886

node-gyp@4.0.0 resolved that vulnerability by removing dependencies on fstream.

I also bumped npm-lifecycle@2.1.0 to 2.1.1, which does the same as above.

The tests don't pass locally, but I'm hoping the reasons why become more clear by running on CI, so that I can resolve them.

Please feel free to close this if it doesn't make sense for some reason I haven't thought of (or of course for any other reason). Thank you all for all you do! 😄

@hughrawlinson
chore: update node-gyp to mitigate a security advisory
387af97
node-gyp@3.8.0 uses fstream@1.0.11, which has this advisory: https://www.npmjs.com/advisories/886
node-gyp@4.0.0 uses fstream@1.0.12, which has resolved the issue
@hughrawlinson
hughrawlinson requested a review from a team as a code ownerMay 22, 2019 13:05
@hughrawlinson
(chore) bump npm-lifecycle
655bc7b
npm-lifecycle@2.1.0 also depends on node-gyp@3.8.0.
Bumping to npm-lifecycle@2.1.1 addresses the issue
@hughrawlinsonhughrawlinson changed the title chore: update node-gyp to mitigate a security advisorychore: mitigate security advisory 886May 22, 2019
@daviwildaviwil mentioned this pull request May 26, 2019
Closed
@valdemonvaldemon mentioned this pull request May 27, 2019
Open
@joaogarinjoaogarin mentioned this pull request May 29, 2019
Closed
@brettz9

brettz9 commented Jun 10, 2019•
edited
Loading

Copy link
Copy Markdown
Contributor

Would be great to get this looked at, as npm audit is listing 12 high risk advisories resulting from these two packages (none of which is npm audit fix working to fix)...

@HaprogHaprog mentioned this pull request Jun 18, 2019
Merged
@gobengogobengo mentioned this pull request Jun 23, 2019
Closed
3 tasks
@isaacs

isaacs commented Jun 26, 2019

Copy link
Copy Markdown
Contributor

Bumping to node-gyp v4 will take some more refactoring, but the fstream vuln will be fixed in the next release. Thanks!

@isaacsisaacs closed this Jun 26, 2019
@hughrawlinson
hughrawlinson deleted the bump-node-gyp branch June 27, 2019 16:58
@gutwrinchgutwrinch mentioned this pull request Oct 19, 2023
Merged
@bumplzz69bumplzz69 mentioned this pull request Nov 30, 2023
Open
@BhanditzBhanditz mentioned this pull request Nov 30, 2023
Open
@snyk-iosnyk-ioBot mentioned this pull request Oct 21, 2024
Open
github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Jul 8, 2026
@github-actions
🤖 봇 응답 (npm#198)
ef97c9f
github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Jul 19, 2026
@github-actions
📊 blog1 게시 완료 (npm#198)
965d1ea
github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Jul 19, 2026
@github-actions
📊 blog2 게시 완료 (npm#198)
60ef570
github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Jul 19, 2026
@github-actions
📊 blog3 게시 완료 (npm#198)
dabf72e
github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Aug 11, 2026
@github-actions
🔧 자동 수리 완료 (npm#198)
ae1e8b1
github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Aug 18, 2026
@github-actions
🔥 트렌드 선점 후보 갱신 (npm#198)
9c396bc
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@hughrawlinson@brettz9@isaacs
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
chore: mitigate security advisory 886 - #198
Closed
hughrawlinson wants to merge 2 commits into
npm:latestfrom 
hughrawlinson:bump-node-gyp
Closed
chore: mitigate security advisory 886#198
hughrawlinson wants to merge 2 commits into
npm:latestfrom 
hughrawlinson:bump-node-gyp
Conversation
@hughrawlinson
@hughrawlinsonhughrawlinson
commented
May 22, 2019•

edited

Loading

Copy link


Copy Markdown

node-gyp@3.8.0 uses fstream@1.0.11, which has this advisory: https://www.npmjs.com/advisories/886
node-gyp@4.0.0 resolved that vulnerability by removing dependencies on fstream.
I also bumped npm-lifecycle@2.1.0 to 2.1.1, which does the same as above.
The tests don't pass locally, but I'm hoping the reasons why become more clear by running on CI, so that I can resolve them.
Please feel free to close this if it doesn't make sense for some reason I haven't thought of (or of course for any other reason). Thank you all for all you do! 😄
@hughrawlinson
chore: update node-gyp to mitigate a security advisory
387af97
node-gyp@3.8.0 uses fstream@1.0.11, which has this advisory: https://www.npmjs.com/advisories/886
node-gyp@4.0.0 uses fstream@1.0.12, which has resolved the issue
@hughrawlinson
hughrawlinson
requested a review
from a team
as a code ownerMay 22, 2019 13:05
@hughrawlinson
(chore) bump npm-lifecycle
655bc7b
npm-lifecycle@2.1.0 also depends on node-gyp@3.8.0.
Bumping to npm-lifecycle@2.1.1 addresses the issue
@hughrawlinsonhughrawlinson
changed the title
chore: update node-gyp to mitigate a security advisorychore: mitigate security advisory 886May 22, 2019
@daviwildaviwil
mentioned this pull request
May 26, 2019

Closed

@valdemonvaldemon
mentioned this pull request
May 27, 2019
 Open

@joaogarinjoaogarin
mentioned this pull request
May 29, 2019

Closed

@brettz9
brettz9
commented
Jun 10, 2019•

edited

Loading

Copy link


Copy Markdown

Contributor
Would be great to get this looked at, as npm audit is listing 12 high risk advisories resulting from these two packages (none of which is npm audit fix working to fix)...
@HaprogHaprog
mentioned this pull request
Jun 18, 2019
 Merged

@gobengogobengo
mentioned this pull request
Jun 23, 2019

Closed

3 tasks
@isaacs
isaacs
commented
Jun 26, 2019

Copy link


Copy Markdown

Contributor
Bumping to node-gyp v4 will take some more refactoring, but the fstream vuln will be fixed in the next release. Thanks!
@isaacsisaacs
closed this
Jun 26, 2019
@hughrawlinson
hughrawlinson
deleted the

bump-node-gyp

branch
June 27, 2019 16:58
@gutwrinchgutwrinch
mentioned this pull request
Oct 19, 2023
 Merged

@bumplzz69bumplzz69
mentioned this pull request
Nov 30, 2023
 Open

@BhanditzBhanditz
mentioned this pull request
Nov 30, 2023
 Open

@snyk-iosnyk-ioBot
mentioned this pull request
Oct 21, 2024
 Open

github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 8, 2026
@github-actions
🤖 봇 응답 (npm#198)
ef97c9f
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog1 게시 완료 (npm#198)
965d1ea
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog2 게시 완료 (npm#198)
60ef570
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog3 게시 완료 (npm#198)
dabf72e
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Aug 11, 2026
@github-actions
🔧 자동 수리 완료 (npm#198)
ae1e8b1
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Aug 18, 2026
@github-actions
🔥 트렌드 선점 후보 갱신 (npm#198)
9c396bc
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@hughrawlinson@brettz9@isaacs

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore: mitigate security advisory 886 - #198
Closed
hughrawlinson wants to merge 2 commits into
npm:latestfrom 
hughrawlinson:bump-node-gyp
Closed
chore: mitigate security advisory 886#198
hughrawlinson wants to merge 2 commits into
npm:latestfrom 
hughrawlinson:bump-node-gyp
Conversation
@hughrawlinson
@hughrawlinsonhughrawlinson
commented
May 22, 2019•

edited

Loading

Copy link


Copy Markdown

node-gyp@3.8.0 uses fstream@1.0.11, which has this advisory: https://www.npmjs.com/advisories/886
node-gyp@4.0.0 resolved that vulnerability by removing dependencies on fstream.
I also bumped npm-lifecycle@2.1.0 to 2.1.1, which does the same as above.
The tests don't pass locally, but I'm hoping the reasons why become more clear by running on CI, so that I can resolve them.
Please feel free to close this if it doesn't make sense for some reason I haven't thought of (or of course for any other reason). Thank you all for all you do! 😄
@hughrawlinson
chore: update node-gyp to mitigate a security advisory
387af97
node-gyp@3.8.0 uses fstream@1.0.11, which has this advisory: https://www.npmjs.com/advisories/886
node-gyp@4.0.0 uses fstream@1.0.12, which has resolved the issue
@hughrawlinson
hughrawlinson
requested a review
from a team
as a code ownerMay 22, 2019 13:05
@hughrawlinson
(chore) bump npm-lifecycle
655bc7b
npm-lifecycle@2.1.0 also depends on node-gyp@3.8.0.
Bumping to npm-lifecycle@2.1.1 addresses the issue
@hughrawlinsonhughrawlinson
changed the title
chore: update node-gyp to mitigate a security advisorychore: mitigate security advisory 886May 22, 2019
@daviwildaviwil
mentioned this pull request
May 26, 2019

Closed

@valdemonvaldemon
mentioned this pull request
May 27, 2019
 Open

@joaogarinjoaogarin
mentioned this pull request
May 29, 2019

Closed

@brettz9
brettz9
commented
Jun 10, 2019•

edited

Loading

Copy link


Copy Markdown

Contributor
Would be great to get this looked at, as npm audit is listing 12 high risk advisories resulting from these two packages (none of which is npm audit fix working to fix)...
@HaprogHaprog
mentioned this pull request
Jun 18, 2019
 Merged

@gobengogobengo
mentioned this pull request
Jun 23, 2019

Closed

3 tasks
@isaacs
isaacs
commented
Jun 26, 2019

Copy link


Copy Markdown

Contributor
Bumping to node-gyp v4 will take some more refactoring, but the fstream vuln will be fixed in the next release. Thanks!
@isaacsisaacs
closed this
Jun 26, 2019
@hughrawlinson
hughrawlinson
deleted the

bump-node-gyp

branch
June 27, 2019 16:58
@gutwrinchgutwrinch
mentioned this pull request
Oct 19, 2023
 Merged

@bumplzz69bumplzz69
mentioned this pull request
Nov 30, 2023
 Open

@BhanditzBhanditz
mentioned this pull request
Nov 30, 2023
 Open

@snyk-iosnyk-ioBot
mentioned this pull request
Oct 21, 2024
 Open

github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 8, 2026
@github-actions
🤖 봇 응답 (npm#198)
ef97c9f
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog1 게시 완료 (npm#198)
965d1ea
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog2 게시 완료 (npm#198)
60ef570
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog3 게시 완료 (npm#198)
dabf72e
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Aug 11, 2026
@github-actions
🔧 자동 수리 완료 (npm#198)
ae1e8b1
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Aug 18, 2026
@github-actions
🔥 트렌드 선점 후보 갱신 (npm#198)
9c396bc
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@hughrawlinson@brettz9@isaacs

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore: mitigate security advisory 886 - #198
Closed
hughrawlinson wants to merge 2 commits into
npm:latestfrom 
hughrawlinson:bump-node-gyp
Closed
chore: mitigate security advisory 886#198
hughrawlinson wants to merge 2 commits into
npm:latestfrom 
hughrawlinson:bump-node-gyp
Conversation
@hughrawlinson
@hughrawlinsonhughrawlinson
commented
May 22, 2019•

edited

Loading

Copy link


Copy Markdown

node-gyp@3.8.0 uses fstream@1.0.11, which has this advisory: https://www.npmjs.com/advisories/886
node-gyp@4.0.0 resolved that vulnerability by removing dependencies on fstream.
I also bumped npm-lifecycle@2.1.0 to 2.1.1, which does the same as above.
The tests don't pass locally, but I'm hoping the reasons why become more clear by running on CI, so that I can resolve them.
Please feel free to close this if it doesn't make sense for some reason I haven't thought of (or of course for any other reason). Thank you all for all you do! 😄
@hughrawlinson
chore: update node-gyp to mitigate a security advisory
387af97
node-gyp@3.8.0 uses fstream@1.0.11, which has this advisory: https://www.npmjs.com/advisories/886
node-gyp@4.0.0 uses fstream@1.0.12, which has resolved the issue
@hughrawlinson
hughrawlinson
requested a review
from a team
as a code ownerMay 22, 2019 13:05
@hughrawlinson
(chore) bump npm-lifecycle
655bc7b
npm-lifecycle@2.1.0 also depends on node-gyp@3.8.0.
Bumping to npm-lifecycle@2.1.1 addresses the issue
@hughrawlinsonhughrawlinson
changed the title
chore: update node-gyp to mitigate a security advisorychore: mitigate security advisory 886May 22, 2019
@daviwildaviwil
mentioned this pull request
May 26, 2019

Closed

@valdemonvaldemon
mentioned this pull request
May 27, 2019
 Open

@joaogarinjoaogarin
mentioned this pull request
May 29, 2019

Closed

@brettz9
brettz9
commented
Jun 10, 2019•

edited

Loading

Copy link


Copy Markdown

Contributor
Would be great to get this looked at, as npm audit is listing 12 high risk advisories resulting from these two packages (none of which is npm audit fix working to fix)...
@HaprogHaprog
mentioned this pull request
Jun 18, 2019
 Merged

@gobengogobengo
mentioned this pull request
Jun 23, 2019

Closed

3 tasks
@isaacs
isaacs
commented
Jun 26, 2019

Copy link


Copy Markdown

Contributor
Bumping to node-gyp v4 will take some more refactoring, but the fstream vuln will be fixed in the next release. Thanks!
@isaacsisaacs
closed this
Jun 26, 2019
@hughrawlinson
hughrawlinson
deleted the

bump-node-gyp

branch
June 27, 2019 16:58
@gutwrinchgutwrinch
mentioned this pull request
Oct 19, 2023
 Merged

@bumplzz69bumplzz69
mentioned this pull request
Nov 30, 2023
 Open

@BhanditzBhanditz
mentioned this pull request
Nov 30, 2023
 Open

@snyk-iosnyk-ioBot
mentioned this pull request
Oct 21, 2024
 Open

github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 8, 2026
@github-actions
🤖 봇 응답 (npm#198)
ef97c9f
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog1 게시 완료 (npm#198)
965d1ea
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog2 게시 완료 (npm#198)
60ef570
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog3 게시 완료 (npm#198)
dabf72e
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Aug 11, 2026
@github-actions
🔧 자동 수리 완료 (npm#198)
ae1e8b1
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Aug 18, 2026
@github-actions
🔥 트렌드 선점 후보 갱신 (npm#198)
9c396bc
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@hughrawlinson@brettz9@isaacs

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
chore: mitigate security advisory 886 - #198
Closed
hughrawlinson wants to merge 2 commits into
npm:latestfrom 
hughrawlinson:bump-node-gyp
Closed
chore: mitigate security advisory 886#198
hughrawlinson wants to merge 2 commits into
npm:latestfrom 
hughrawlinson:bump-node-gyp
Conversation
@hughrawlinson
@hughrawlinsonhughrawlinson
commented
May 22, 2019•

edited

Loading

Copy link


Copy Markdown

node-gyp@3.8.0 uses fstream@1.0.11, which has this advisory: https://www.npmjs.com/advisories/886
node-gyp@4.0.0 resolved that vulnerability by removing dependencies on fstream.
I also bumped npm-lifecycle@2.1.0 to 2.1.1, which does the same as above.
The tests don't pass locally, but I'm hoping the reasons why become more clear by running on CI, so that I can resolve them.
Please feel free to close this if it doesn't make sense for some reason I haven't thought of (or of course for any other reason). Thank you all for all you do! 😄
@hughrawlinson
chore: update node-gyp to mitigate a security advisory
387af97
node-gyp@3.8.0 uses fstream@1.0.11, which has this advisory: https://www.npmjs.com/advisories/886
node-gyp@4.0.0 uses fstream@1.0.12, which has resolved the issue
@hughrawlinson
hughrawlinson
requested a review
from a team
as a code ownerMay 22, 2019 13:05
@hughrawlinson
(chore) bump npm-lifecycle
655bc7b
npm-lifecycle@2.1.0 also depends on node-gyp@3.8.0.
Bumping to npm-lifecycle@2.1.1 addresses the issue
@hughrawlinsonhughrawlinson
changed the title
chore: update node-gyp to mitigate a security advisorychore: mitigate security advisory 886May 22, 2019
@daviwildaviwil
mentioned this pull request
May 26, 2019

Closed

@valdemonvaldemon
mentioned this pull request
May 27, 2019
 Open

@joaogarinjoaogarin
mentioned this pull request
May 29, 2019

Closed

@brettz9
brettz9
commented
Jun 10, 2019•

edited

Loading

Copy link


Copy Markdown

Contributor
Would be great to get this looked at, as npm audit is listing 12 high risk advisories resulting from these two packages (none of which is npm audit fix working to fix)...
@HaprogHaprog
mentioned this pull request
Jun 18, 2019
 Merged

@gobengogobengo
mentioned this pull request
Jun 23, 2019

Closed

3 tasks
@isaacs
isaacs
commented
Jun 26, 2019

Copy link


Copy Markdown

Contributor
Bumping to node-gyp v4 will take some more refactoring, but the fstream vuln will be fixed in the next release. Thanks!
@isaacsisaacs
closed this
Jun 26, 2019
@hughrawlinson
hughrawlinson
deleted the

bump-node-gyp

branch
June 27, 2019 16:58
@gutwrinchgutwrinch
mentioned this pull request
Oct 19, 2023
 Merged

@bumplzz69bumplzz69
mentioned this pull request
Nov 30, 2023
 Open

@BhanditzBhanditz
mentioned this pull request
Nov 30, 2023
 Open

@snyk-iosnyk-ioBot
mentioned this pull request
Oct 21, 2024
 Open

github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 8, 2026
@github-actions
🤖 봇 응답 (npm#198)
ef97c9f
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog1 게시 완료 (npm#198)
965d1ea
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog2 게시 완료 (npm#198)
60ef570
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog3 게시 완료 (npm#198)
dabf72e
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Aug 11, 2026
@github-actions
🔧 자동 수리 완료 (npm#198)
ae1e8b1
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Aug 18, 2026
@github-actions
🔥 트렌드 선점 후보 갱신 (npm#198)
9c396bc
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@hughrawlinson@brettz9@isaacs

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore: mitigate security advisory 886 - #198
Closed
hughrawlinson wants to merge 2 commits into
npm:latestfrom 
hughrawlinson:bump-node-gyp
Closed
chore: mitigate security advisory 886#198
hughrawlinson wants to merge 2 commits into
npm:latestfrom 
hughrawlinson:bump-node-gyp
Conversation
@hughrawlinson
@hughrawlinsonhughrawlinson
commented
May 22, 2019•

edited

Loading

Copy link


Copy Markdown

node-gyp@3.8.0 uses fstream@1.0.11, which has this advisory: https://www.npmjs.com/advisories/886
node-gyp@4.0.0 resolved that vulnerability by removing dependencies on fstream.
I also bumped npm-lifecycle@2.1.0 to 2.1.1, which does the same as above.
The tests don't pass locally, but I'm hoping the reasons why become more clear by running on CI, so that I can resolve them.
Please feel free to close this if it doesn't make sense for some reason I haven't thought of (or of course for any other reason). Thank you all for all you do! 😄
@hughrawlinson
chore: update node-gyp to mitigate a security advisory
387af97
node-gyp@3.8.0 uses fstream@1.0.11, which has this advisory: https://www.npmjs.com/advisories/886
node-gyp@4.0.0 uses fstream@1.0.12, which has resolved the issue
@hughrawlinson
hughrawlinson
requested a review
from a team
as a code ownerMay 22, 2019 13:05
@hughrawlinson
(chore) bump npm-lifecycle
655bc7b
npm-lifecycle@2.1.0 also depends on node-gyp@3.8.0.
Bumping to npm-lifecycle@2.1.1 addresses the issue
@hughrawlinsonhughrawlinson
changed the title
chore: update node-gyp to mitigate a security advisorychore: mitigate security advisory 886May 22, 2019
@daviwildaviwil
mentioned this pull request
May 26, 2019

Closed

@valdemonvaldemon
mentioned this pull request
May 27, 2019
 Open

@joaogarinjoaogarin
mentioned this pull request
May 29, 2019

Closed

@brettz9
brettz9
commented
Jun 10, 2019•

edited

Loading

Copy link


Copy Markdown

Contributor
Would be great to get this looked at, as npm audit is listing 12 high risk advisories resulting from these two packages (none of which is npm audit fix working to fix)...
@HaprogHaprog
mentioned this pull request
Jun 18, 2019
 Merged

@gobengogobengo
mentioned this pull request
Jun 23, 2019

Closed

3 tasks
@isaacs
isaacs
commented
Jun 26, 2019

Copy link


Copy Markdown

Contributor
Bumping to node-gyp v4 will take some more refactoring, but the fstream vuln will be fixed in the next release. Thanks!
@isaacsisaacs
closed this
Jun 26, 2019
@hughrawlinson
hughrawlinson
deleted the

bump-node-gyp

branch
June 27, 2019 16:58
@gutwrinchgutwrinch
mentioned this pull request
Oct 19, 2023
 Merged

@bumplzz69bumplzz69
mentioned this pull request
Nov 30, 2023
 Open

@BhanditzBhanditz
mentioned this pull request
Nov 30, 2023
 Open

@snyk-iosnyk-ioBot
mentioned this pull request
Oct 21, 2024
 Open

github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 8, 2026
@github-actions
🤖 봇 응답 (npm#198)
ef97c9f
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog1 게시 완료 (npm#198)
965d1ea
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog2 게시 완료 (npm#198)
60ef570
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog3 게시 완료 (npm#198)
dabf72e
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Aug 11, 2026
@github-actions
🔧 자동 수리 완료 (npm#198)
ae1e8b1
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Aug 18, 2026
@github-actions
🔥 트렌드 선점 후보 갱신 (npm#198)
9c396bc
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@hughrawlinson@brettz9@isaacs

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore: mitigate security advisory 886 - #198
Closed
hughrawlinson wants to merge 2 commits into
npm:latestfrom 
hughrawlinson:bump-node-gyp
Closed
chore: mitigate security advisory 886#198
hughrawlinson wants to merge 2 commits into
npm:latestfrom 
hughrawlinson:bump-node-gyp
Conversation
@hughrawlinson
@hughrawlinsonhughrawlinson
commented
May 22, 2019•

edited

Loading

Copy link


Copy Markdown

node-gyp@3.8.0 uses fstream@1.0.11, which has this advisory: https://www.npmjs.com/advisories/886
node-gyp@4.0.0 resolved that vulnerability by removing dependencies on fstream.
I also bumped npm-lifecycle@2.1.0 to 2.1.1, which does the same as above.
The tests don't pass locally, but I'm hoping the reasons why become more clear by running on CI, so that I can resolve them.
Please feel free to close this if it doesn't make sense for some reason I haven't thought of (or of course for any other reason). Thank you all for all you do! 😄
@hughrawlinson
chore: update node-gyp to mitigate a security advisory
387af97
node-gyp@3.8.0 uses fstream@1.0.11, which has this advisory: https://www.npmjs.com/advisories/886
node-gyp@4.0.0 uses fstream@1.0.12, which has resolved the issue
@hughrawlinson
hughrawlinson
requested a review
from a team
as a code ownerMay 22, 2019 13:05
@hughrawlinson
(chore) bump npm-lifecycle
655bc7b
npm-lifecycle@2.1.0 also depends on node-gyp@3.8.0.
Bumping to npm-lifecycle@2.1.1 addresses the issue
@hughrawlinsonhughrawlinson
changed the title
chore: update node-gyp to mitigate a security advisorychore: mitigate security advisory 886May 22, 2019
@daviwildaviwil
mentioned this pull request
May 26, 2019

Closed

@valdemonvaldemon
mentioned this pull request
May 27, 2019
 Open

@joaogarinjoaogarin
mentioned this pull request
May 29, 2019

Closed

@brettz9
brettz9
commented
Jun 10, 2019•

edited

Loading

Copy link


Copy Markdown

Contributor
Would be great to get this looked at, as npm audit is listing 12 high risk advisories resulting from these two packages (none of which is npm audit fix working to fix)...
@HaprogHaprog
mentioned this pull request
Jun 18, 2019
 Merged

@gobengogobengo
mentioned this pull request
Jun 23, 2019

Closed

3 tasks
@isaacs
isaacs
commented
Jun 26, 2019

Copy link


Copy Markdown

Contributor
Bumping to node-gyp v4 will take some more refactoring, but the fstream vuln will be fixed in the next release. Thanks!
@isaacsisaacs
closed this
Jun 26, 2019
@hughrawlinson
hughrawlinson
deleted the

bump-node-gyp

branch
June 27, 2019 16:58
@gutwrinchgutwrinch
mentioned this pull request
Oct 19, 2023
 Merged

@bumplzz69bumplzz69
mentioned this pull request
Nov 30, 2023
 Open

@BhanditzBhanditz
mentioned this pull request
Nov 30, 2023
 Open

@snyk-iosnyk-ioBot
mentioned this pull request
Oct 21, 2024
 Open

github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 8, 2026
@github-actions
🤖 봇 응답 (npm#198)
ef97c9f
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog1 게시 완료 (npm#198)
965d1ea
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog2 게시 완료 (npm#198)
60ef570
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog3 게시 완료 (npm#198)
dabf72e
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Aug 11, 2026
@github-actions
🔧 자동 수리 완료 (npm#198)
ae1e8b1
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Aug 18, 2026
@github-actions
🔥 트렌드 선점 후보 갱신 (npm#198)
9c396bc
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@hughrawlinson@brettz9@isaacs

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
chore: mitigate security advisory 886 - #198
Closed
hughrawlinson wants to merge 2 commits into
npm:latestfrom 
hughrawlinson:bump-node-gyp
Closed
chore: mitigate security advisory 886#198
hughrawlinson wants to merge 2 commits into
npm:latestfrom 
hughrawlinson:bump-node-gyp
Conversation
@hughrawlinson
@hughrawlinsonhughrawlinson
commented
May 22, 2019•

edited

Loading

Copy link


Copy Markdown

node-gyp@3.8.0 uses fstream@1.0.11, which has this advisory: https://www.npmjs.com/advisories/886
node-gyp@4.0.0 resolved that vulnerability by removing dependencies on fstream.
I also bumped npm-lifecycle@2.1.0 to 2.1.1, which does the same as above.
The tests don't pass locally, but I'm hoping the reasons why become more clear by running on CI, so that I can resolve them.
Please feel free to close this if it doesn't make sense for some reason I haven't thought of (or of course for any other reason). Thank you all for all you do! 😄
@hughrawlinson
chore: update node-gyp to mitigate a security advisory
387af97
node-gyp@3.8.0 uses fstream@1.0.11, which has this advisory: https://www.npmjs.com/advisories/886
node-gyp@4.0.0 uses fstream@1.0.12, which has resolved the issue
@hughrawlinson
hughrawlinson
requested a review
from a team
as a code ownerMay 22, 2019 13:05
@hughrawlinson
(chore) bump npm-lifecycle
655bc7b
npm-lifecycle@2.1.0 also depends on node-gyp@3.8.0.
Bumping to npm-lifecycle@2.1.1 addresses the issue
@hughrawlinsonhughrawlinson
changed the title
chore: update node-gyp to mitigate a security advisorychore: mitigate security advisory 886May 22, 2019
@daviwildaviwil
mentioned this pull request
May 26, 2019

Closed

@valdemonvaldemon
mentioned this pull request
May 27, 2019
 Open

@joaogarinjoaogarin
mentioned this pull request
May 29, 2019

Closed

@brettz9
brettz9
commented
Jun 10, 2019•

edited

Loading

Copy link


Copy Markdown

Contributor
Would be great to get this looked at, as npm audit is listing 12 high risk advisories resulting from these two packages (none of which is npm audit fix working to fix)...
@HaprogHaprog
mentioned this pull request
Jun 18, 2019
 Merged

@gobengogobengo
mentioned this pull request
Jun 23, 2019

Closed

3 tasks
@isaacs
isaacs
commented
Jun 26, 2019

Copy link


Copy Markdown

Contributor
Bumping to node-gyp v4 will take some more refactoring, but the fstream vuln will be fixed in the next release. Thanks!
@isaacsisaacs
closed this
Jun 26, 2019
@hughrawlinson
hughrawlinson
deleted the

bump-node-gyp

branch
June 27, 2019 16:58
@gutwrinchgutwrinch
mentioned this pull request
Oct 19, 2023
 Merged

@bumplzz69bumplzz69
mentioned this pull request
Nov 30, 2023
 Open

@BhanditzBhanditz
mentioned this pull request
Nov 30, 2023
 Open

@snyk-iosnyk-ioBot
mentioned this pull request
Oct 21, 2024
 Open

github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 8, 2026
@github-actions
🤖 봇 응답 (npm#198)
ef97c9f
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog1 게시 완료 (npm#198)
965d1ea
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog2 게시 완료 (npm#198)
60ef570
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Jul 19, 2026
@github-actions
📊 blog3 게시 완료 (npm#198)
dabf72e
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Aug 11, 2026
@github-actions
🔧 자동 수리 완료 (npm#198)
ae1e8b1
github-actionsBot
added a commit
to Kevinlee7250/cli
that referenced
this pull request
Aug 18, 2026
@github-actions
🔥 트렌드 선점 후보 갱신 (npm#198)
9c396bc
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@hughrawlinson@brettz9@isaacs