Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade minimist to 0.2.1 #8

Closed
wants to merge 1 commit into from
Closed

Upgrade minimist to 0.2.1 #8

wants to merge 1 commit into from

Conversation

mKeRix
Copy link

@mKeRix mKeRix commented Mar 14, 2020

Fixes #7 - vulnerability in dependency:
https://snyk.io/vuln/SNYK-JS-MINIMIST-559764

I created a new branch from commit d4eff0f called v0.x for this fix. Unfortunately I can't create a PR based on a non-existent branch on your repo, so I would appreciate it a lot if you could create a branch off that commit as well, merge this PR there and then release v0.5.2 to npm.

@karlhorky
Copy link

karlhorky commented Mar 15, 2020

Edit: Use mkdirp@0.5.3 - the problem is fixed there.

For anyone looking for a fix for the interim, using Yarn Resolutions you can specify this version number, even though it doesn't match the semver range of mkdirp.

Add this to your package.json if you're using Yarn and run yarn to update your lockfile:

  "resolutions": {
    "**/mkdirp/minimist": "0.2.1"
  }

@canpolatoral
Copy link

When will you merge this pull request?

@JaymoKang
Copy link

@isaacs

@LinusU
Copy link

LinusU commented Mar 17, 2020

This have already been released as 0.5.3 on Npm, please see #7 for more details.

@mKeRix
Copy link
Author

mKeRix commented Mar 17, 2020

Thanks for the fix @isaacs!

@mKeRix mKeRix closed this Mar 17, 2020
@mKeRix mKeRix deleted the v0.x branch March 17, 2020 20:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

ship a fix for mkdirp@0.5.1 due minimist
6 participants