Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix/1413: change merge to merge-anything dependency for resolve prototype pollution vulnerability #1420

Merged
merged 1 commit into from
Apr 20, 2023

Conversation

samydavd
Copy link
Contributor

All Submissions:

  • Have you followed the guidelines in our Contributing document?
  • Have you checked to ensure there aren't other open Pull Requests for the same update/change?
  • Have you written unit tests? (NA)
  • Have you written unit tests that cover the negative cases (i.e.: if bad data is submitted, does the library respond properly)? (NA)
  • This PR is associated with an existing issue?

Closing issues

closes #1413

If this is a new feature submission:

  • Has the issue had a maintainer respond to the issue and clarify that the feature is something that aligns with the goals and philosophy of the project?

Potential Problems With The Approach
None, it's a clean change of the merge dependency for the merge-anything dependency using the same recursive strategy but avoiding the prototype pollution vulnerability

Test plan
The current tests are satisfied and no flow is broken.

Copy link

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello there samydavd 👋

Thank you and congrats 🎉 for opening your first PR on this project.✨

We will review the following PR soon! 👀

@samydavd samydavd changed the title Fix: change merge dependency to merge-anything for resolve prototype pollution vulnerability Fix/1413: change merge dependency to merge-anything for resolve prototype pollution vulnerability Apr 18, 2023
@samydavd samydavd changed the title Fix/1413: change merge dependency to merge-anything for resolve prototype pollution vulnerability Fix/1413: change merge to merge-anything dependency for resolve prototype pollution vulnerability Apr 18, 2023
@samydavd
Copy link
Contributor Author

samydavd commented Apr 18, 2023

Additionally, the dependency-check reports are shown:

@samydavd
Copy link
Contributor Author

Hi, please merge or is something missing?

@WoH
Copy link
Collaborator

WoH commented Apr 20, 2023

LGTM, thanks!

@WoH WoH merged commit 0f4e2ad into lukeautry:master Apr 20, 2023
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Consider replacing merge and through dependencies
2 participants