Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE because of dependency on yaml@2.2.1 #2280

Closed
aukevanleeuwen opened this issue Apr 26, 2023 · 2 comments · Fixed by #2281
Closed

CVE because of dependency on yaml@2.2.1 #2280

aukevanleeuwen opened this issue Apr 26, 2023 · 2 comments · Fixed by #2281

Comments

@aukevanleeuwen
Copy link
Member

🤔 What's the problem you've observed?

I was alerted by dependabot of a vulnerability because of a transitive dependency on yaml@2.2.1 (via @cucumber/cucumber-js).

✨ Do you have a proposal for making it better?

Update to yaml@2.2.2.

📚 Any additional context?
aukevanleeuwen added a commit to aukevanleeuwen/cucumber-js that referenced this issue Apr 26, 2023
@aukevanleeuwen
Update yaml to v2.2.2 to remedy CVE-2023-2251
536b75f 
More information:
* GHSA-f9xv-q969-pqx4
* https://nvd.nist.gov/vuln/detail/CVE-2023-2251

Fixes cucumber#2280
@aukevanleeuwen aukevanleeuwen mentioned this issue Apr 26, 2023
Merged
7 tasks
davidjgoss pushed a commit that referenced this issue Apr 27, 2023
@aukevanleeuwen
Update yaml to v2.2.2 to remedy CVE-2023-2251 (#2281)
951114c 
More information:
* GHSA-f9xv-q969-pqx4
* https://nvd.nist.gov/vuln/detail/CVE-2023-2251

Fixes #2280
@bchew
Copy link

bchew commented May 1, 2023

@davidjgoss is there a plan for a release to npm with this fix soon? Thanks

@davidjgoss
Copy link
Contributor

Released in https://github.com/cucumber/cucumber-js/releases/tag/v9.1.1 - sorry for the delay.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Update yaml to v2.2.2 to remedy CVE-2023-2251 aukevanleeuwen/cucumber-js
3 participants
@aukevanleeuwen @bchew @davidjgoss