Skip to content

Commit

Permalink
fix(deps): force minimist >=1.2.6 for CVE-2021-44906
Browse files Browse the repository at this point in the history
Ensures that yarn will only install 1.2.6 or newer versions for
minimist.

The proper fix would be to have the dependencies issue releases
which upgrade their own (transitive) dependencies of minimist
so that we don't have to explicitly force it here, but at the time
of this writing these upgrades in our direct dependencies are just
not available yet.

Fixes #1943

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
  • Loading branch information
petermetz authored and takeutak committed Mar 23, 2022
1 parent 824f5c8 commit b96806a
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,7 @@
"ansi-html": ">0.0.8",
"glob-parent": "5.1.2",
"lodash": "4.17.20",
"minimist": ">=1.2.6",
"underscore": "1.13.2"
}
}

0 comments on commit b96806a

Please sign in to comment.