# How update aurelia-path

**URL:** <https://discourse.aurelia.io/t/how-update-aurelia-path/4456>\
**Category:** Uncategorized\
**Created:** [October 28, 2021, 7:02am UTC](https://discourse.aurelia.io/t/how-update-aurelia-path/4456 "2021-10-28T07:02:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jkowalski](https://avatars.discourse-cdn.com/v4/letter/j/a183cd/32.png) [@jkowalski](https://discourse.aurelia.io/u/jkowalski)\
**Post date:** [October 28, 2021, 7:02am UTC](https://discourse.aurelia.io/t/how-update-aurelia-path/4456/1 "2021-10-28T07:02:57Z")

</div>

In our Aurelia v1 (1.3.1) project we see that aurelia-path has vulnerability:

> **[CVE-2021-41097 - GitHub Advisory Database](https://github.com/advisories/GHSA-3c9c-2p65-qvwv)**
>
> Prototype pollution in aurelia-path

How we could update this nested dependency without updating Aurelia to v2?

---

<div class="post-metadata">

**Author:** ![huochunpeng](https://avatars.discourse-cdn.com/v4/letter/h/49beb7/32.png) [@huochunpeng](https://discourse.aurelia.io/u/huochunpeng)\
**Post date:** [October 28, 2021, 7:18am UTC](https://discourse.aurelia.io/t/how-update-aurelia-path/4456/2 "2021-10-28T07:18:04Z")

</div>

Just remove package-lock.json (or yarn.lock) and node\_modules, then reinstall packages again.

To verify the version of any local package, you can do

```
npm ls aurelia-path

```

The latest version of aurelia-path is v1.1.7.