Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Dependency attack specifically targeting ps-tree #33

Closed
FallingSnow opened this issue Nov 20, 2018 · 1 comment
Closed

Dependency attack specifically targeting ps-tree #33

FallingSnow opened this issue Nov 20, 2018 · 1 comment

Comments

@FallingSnow
Copy link

One of your dependencies (event-stream) has an injection that specifically targets this package. Update to event-stream to 4.x to remove it. More info: dominictarr/event-stream#116
@FallingSnow FallingSnow changed the title Dependency attack specifically targeting you Dependency attack specifically targeting ps-tree Nov 20, 2018
This was referenced Nov 26, 2018
Closed
Closed
@ChrisBAshton ChrisBAshton mentioned this issue Nov 26, 2018
Closed
@cuongluu8 cuongluu8 mentioned this issue Nov 26, 2018
Closed
@parktheredcar parktheredcar mentioned this issue Nov 26, 2018
Closed
@ajfarkas ajfarkas mentioned this issue Nov 26, 2018
Closed
@indexzero
Copy link
Owner

FYI ps-tree@1.1.1 locked to event-stream@3.3.4 (which if I read this thread correctly pre-dates the questionable changes).

Thanks to folks for bringing it to my attention: #34

@ramsaylanier ramsaylanier mentioned this issue Nov 26, 2018
Closed
@ef4 ef4 mentioned this issue Nov 26, 2018
Closed
@melanieseltzer melanieseltzer mentioned this issue Nov 26, 2018
Merged
@Izhaki Izhaki mentioned this issue Nov 26, 2018
Closed
@wkillerud wkillerud mentioned this issue Nov 27, 2018
Closed
@dervism dervism mentioned this issue Nov 27, 2018
Closed
@punitx punitx mentioned this issue Nov 27, 2018
Merged
@dervism dervism mentioned this issue Nov 27, 2018
Merged
@angelsk angelsk mentioned this issue Nov 27, 2018
Closed
kentcdodds pushed a commit to kentcdodds/spawn-command-with-kill that referenced this issue Nov 27, 2018
@dervism
fix: upgrade ps-tree to a safe version. (#2)
1d6d679 
See indexzero/ps-tree#33
@jpmnteiro jpmnteiro mentioned this issue Nov 30, 2018
Closed
@el-rotny el-rotny mentioned this issue Dec 20, 2018
Closed
@estreiten estreiten mentioned this issue Dec 21, 2018
Closed
@Izhaki Izhaki mentioned this issue Dec 23, 2018
Merged
This was referenced Jan 12, 2019
Merged
Merged
@dependabot-preview dependabot-preview bot mentioned this issue Jan 28, 2019
Merged
easyCZ pushed a commit to improbable-eng/grpc-web that referenced this issue Jan 31, 2019
@dependabot @easyCZ
Bump browserstack-local from 1.3.4 to 1.3.7 (#310)
924b099 
[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

If you make any changes to it yourself then they will take precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps [browserstack-local](https://github.com/browserstack/browserstack-local-nodejs) from 1.3.4 to 1.3.7.
<details>
<summary>Release notes</summary>

*Sourced from [browserstack-local's releases](https://github.com/browserstack/browserstack-local-nodejs/releases).*

> ## Locked ps-tree version to 1.1.1
> This library has a dependency on ps-tree, which has a dependency on event-stream which had a security bug in newer versions.
> Hence locked ps-tree's version to 1.1.1 which uses event-stream's secure version 3.3.4
> 
> For more details, please refer:
> indexzero/ps-tree#33
> dominictarr/event-stream#116
> 
> ## Changed local binary paths to support LocalBinary 7.3. Fixed folder argument.
> Changed local binary paths to support LocalBinary 7.3. 
> Fixed folder argument when building browserstack local arguments.
</details>
<details>
<summary>Commits</summary>

- [`230ec93`](browserstack/browserstack-local-nodejs@230ec93) Merge pull request [#66](https://github-redirect.dependabot.com/browserstack/browserstack-local-nodejs/issues/66) from punitx/lock_ps_tree_version
- [`2c74310`](browserstack/browserstack-local-nodejs@2c74310) Bumped package version to 1.3.7
- [`0c5043f`](browserstack/browserstack-local-nodejs@0c5043f) Locked ps-tree version to 1.1.1
- [`e1f22d5`](browserstack/browserstack-local-nodejs@e1f22d5) Revert "Merge pull request [#65](https://github-redirect.dependabot.com/browserstack/browserstack-local-nodejs/issues/65) from yohan-pereira/remove_pstree"
- [`dfea668`](browserstack/browserstack-local-nodejs@dfea668) Merge pull request [#65](https://github-redirect.dependabot.com/browserstack/browserstack-local-nodejs/issues/65) from yohan-pereira/remove_pstree
- [`caf72de`](browserstack/browserstack-local-nodejs@caf72de) Revert "Overriding stop method for fixing stop local issue in docker [#56](https://github-redirect.dependabot.com/browserstack/browserstack-local-nodejs/issues/56)"
- [`5fec9d5`](browserstack/browserstack-local-nodejs@5fec9d5) Merge pull request [#63](https://github-redirect.dependabot.com/browserstack/browserstack-local-nodejs/issues/63) from browserstack/version_bump
- [`f03131c`](browserstack/browserstack-local-nodejs@f03131c) Version Bump
- [`ad3e3de`](browserstack/browserstack-local-nodejs@ad3e3de) Merge pull request [#62](https://github-redirect.dependabot.com/browserstack/browserstack-local-nodejs/issues/62) from browserstack/fix-folder-flg
- [`5a5a32a`](browserstack/browserstack-local-nodejs@5a5a32a) Fix argument order sent via command line to browserstack local binary.
- Additional commits viewable in [compare view](browserstack/browserstack-local-nodejs@v1.3.4...1.3.7)
</details>
<br />

[![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=browserstack-local&package-manager=npm_and_yarn&previous-version=1.3.4&new-version=1.3.7)](https://dependabot.com/compatibility-score.html?dependency-name=browserstack-local&package-manager=npm_and_yarn&previous-version=1.3.4&new-version=1.3.7)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @easyCZ.

[//]: # (dependabot-automerge-end)

---

**Note:** This repo was added to Dependabot recently, so you'll receive a maximum of 5 PRs for your first few update runs. Once an update run creates fewer than 5 PRs we'll remove that limit.

You can always request more updates by clicking `Bump now` in your [Dependabot dashboard](https://app.dependabot.com).

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

</details>
@jeremywadsack jeremywadsack mentioned this issue Feb 15, 2023
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@indexzero @FallingSnow