Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update sublibrary elliptic for CVE-2020-13822 #3731

Closed
wants to merge 2 commits into from
Closed

update sublibrary elliptic for CVE-2020-13822 #3731

wants to merge 2 commits into from

Conversation

cokia
Copy link
Contributor

@cokia cokia commented Sep 27, 2020

Description

about #3729 issue.

update sub library "elliptic" and depth under 13 level.

for more information of vlun, please refer to "GHSA-vh7m-p724-62c2"

Type of change

  • Bug fix (non-breaking change which fixes an issue)

Checklist:

  • I have selected the correct base branch.
  • I have performed a self-review of my own code.
  • I have commented my code, particularly in hard-to-understand areas.
  • I have made corresponding changes to the documentation.
  • My changes generate no new warnings.
  • Any dependent changes have been merged and published in downstream modules.
  • I ran npm run dtslint with success and extended the tests and types if necessary.
  • I ran npm run test:unit with success.
  • I ran npm run test:cov and my test cases cover all the lines and branches of the added code.
  • I ran npm run build and tested dist/web3.min.js in a browser.
  • I have tested my code on the live network.
  • I have checked the Deploy Preview and it looks correct.
  • I have updated the CHANGELOG.md file in the root folder.

@coveralls
Copy link

coveralls commented Sep 27, 2020

Coverage Status

Coverage increased (+2.3%) to 80.373% when pulling db0b2c0 on cokia:1.x into 4615f2d on ethereum:1.x.

@GregTheGreek
Copy link
Contributor

This should probably affect the package.json as well?

Copy link
Contributor

@frankiebee frankiebee left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for the sub dep bump

@GregTheGreek
Copy link
Contributor

@cokia can you bump the package-lock we want to make a release :)

@github-actions
Copy link

This PR has been automatically marked as stale beacause it has not had recent activity. It will be closed in 7 days if no further activity occurs. Thank you for your contributions. If you believe this was a mistake, please comment.

@github-actions github-actions bot added the Stale Has not received enough activity label Dec 19, 2020
@cokia cokia closed this Dec 19, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Stale Has not received enough activity
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants