From 2c1a86431dd2d818b255ad21075d623d024f17c1 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Tue, 3 Jul 2018 00:16:07 +0000 Subject: [PATCH] fix: .snyk & package.json to reduce vulnerabilities The following vulnerabilities are fixed with a Snyk patch: - https://snyk.io/vuln/npm:lodash:20180130 --- .snyk | 7 ++++++- package.json | 5 +++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.snyk b/.snyk index c4048b2..f5cc924 100644 --- a/.snyk +++ b/.snyk @@ -1,5 +1,5 @@ # Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. -version: v1.7.0 +version: v1.12.0 # ignores vulnerabilities until expiry date; change duration by modifying expiry date ignore: 'npm:minimatch:20160620': @@ -137,3 +137,8 @@ patch: patched: '2016-08-09T00:11:35.413Z' - browser-sync > socket.io > engine.io > ws: patched: '2016-08-09T00:11:35.413Z' + 'npm:lodash:20180130': + - student-debt-calc > snyk > lodash: + patched: '2018-07-03T00:16:06.480Z' + - student-debt-calc > snyk > inquirer > lodash: + patched: '2018-07-03T00:16:06.480Z' diff --git a/package.json b/package.json index 98e5893..4393924 100644 --- a/package.json +++ b/package.json @@ -17,7 +17,8 @@ ], "scripts": { "test": "snyk test && mocha test/js-unit/", - "snyk-protect": "snyk protect" + "snyk-protect": "snyk protect", + "prepare": "npm run snyk-protect" }, "devDependencies": { "browser-sync": "2.14.0", @@ -60,7 +61,7 @@ "normalize-legacy-addon": "0.1.0", "number-to-words": "1.2.3", "require-dir": "0.3.0", - "snyk": "1.24.6", + "snyk": "^1.88.0", "sticky-kit": "1.1.3", "student-debt-calc": "2.6.3" },