markkauffman2000
I’m quite new to Phoenix, and Node.js for that matter. If you can help me and other newcomers with this one that would be great. The issue is that a couple of Phoenix projects I’ve published in GitHub, ex: GitHub - mark-b-kauffman/phoenixDSK3LO: phoenixDSK with 3-legged OAuth · GitHub , are now marked with a security vulnerability having to do with Node, package-json.lock, and growl. I tried npm install, and removing package-json.lock and running npm install again. I still end up with the old, vulnerable, version of growl.
My question is simple - how do I rebuild the node/brunch stuff in a Phoenix project to use newer versions of node, esp. one that doesn’t have that vulnerability? I could start over with a new Phoenix project and copy my code over - but if there is a way to do this in place, that would be best. Please provide a reasonable amount of detail.
Thank you.
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Error tracking, logs, APM, uptime and cron monitoring in one dev-friendly platform. Find and fix problems before your users notice.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #blog-post
- #elixirconf-us
- #elixir-ls
- #ai
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Practical resources that improve the lives of professional developers.
**Building the future of software with AI, trust, and human connection.**
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 1- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
Nicd
Looking at your package lock file, it looks like
growlis pulled in byloggythat is pulled in by Brunch. That lead me to find this issue report where the resolution was to updateloggyto a new version that no longer usesgrowl.Unfortunately Brunch also depends on
deppackthat depends on an old version ofloggy, so just upgrading Brunch to the latest version may not fix the issue.Apparently it may be possible to force the usage of a recent version of
loggyby usingnpm shrinkwrap, but I do not know enough about how it works. In the future versions, Phoenix is moving away from Brunch to Webpack, which would also solve your problem (and I think there are blogposts already on how to make the switch).