Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Force update minimist dependency #1380

Merged
merged 1 commit into from
Mar 23, 2022
Merged

Force update minimist dependency #1380

merged 1 commit into from
Mar 23, 2022

Conversation

kamil-stripe
Copy link
Contributor

@kamil-stripe kamil-stripe commented Mar 23, 2022 •
edited
Loading

Bumps minimist from 1.2.5 to 1.2.6.

Affected versions of this package are vulnerable to Prototype Pollution due to a missing handler to Function.prototype. Note: this is a bypass to CVE-2020-7598

dcr-stripe
dcr-stripe approved these changes Mar 23, 2022
View reviewed changes
Copy link
Contributor

@dcr-stripe dcr-stripe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - let's add a proper PR description though just explaining what we changed and why we had to force pin it.

@kamil-stripe kamil-stripe merged commit 45a42fb into master Mar 23, 2022
@kamil-stripe kamil-stripe deleted the kamil/minimist branch March 23, 2022 21:43
@kamil-stripe kamil-stripe mentioned this pull request Mar 23, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dcr-stripe dcr-stripe dcr-stripe approved these changes

Assignees

@kamil-stripe kamil-stripe

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@kamil-stripe @dcr-stripe