Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix/vulerability dot prop 4.2 #2647

Closed
wants to merge 3 commits into from

Conversation

deleonio
Copy link

@deleonio deleonio commented Jul 4, 2020

Description

Vulnerable module: dot-prop
Introduced through: dot-prop@4.2.0

Link: https://snyk.io/test/npm/@lerna/project/3.21.0

Motivation and Context

Remove vulnerability.

How Has This Been Tested?

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have read the CONTRIBUTING document.
  • I have added tests to cover my changes.
  • All new and existing tests passed.

Copy link

@jimmyandrade jimmyandrade left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@evocateur evocateur changed the base branch from master to main November 8, 2020 00:40
@oaosman84
Copy link

Any news on getting this merged / released? This fixes a high-pri vulnerability in the dot-prop dependency, and it looks like there are multiple PRs with this change that never got merged

@evocateur
Copy link
Member

v4.0.0 (now available as lerna@next) should resolve this.

@evocateur evocateur closed this Feb 10, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants