Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update dependency object-path to 0.11.5 [security] #25

Merged
merged 1 commit into from Jun 23, 2021

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jun 23, 2021

WhiteSource Renovate

This PR contains the following updates:

Package Change
object-path 0.11.4 -> 0.11.5

GitHub Vulnerability Alerts

CVE-2020-15256

Impact

A prototype pollution vulnerability has been found in object-path <= 0.11.4 affecting the set() method. The vulnerability is limited to the includeInheritedProps mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of object-path and setting the option includeInheritedProps: true, or by using the default withInheritedProps instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of set() in versions < 0.11.0 is vulnerable.

Patches

Upgrade to version >= 0.11.5

Workarounds

Don't use the includeInheritedProps: true options or the withInheritedProps instance if using a version >= 0.11.0.

References

Read more about the prototype pollution vulnerability

For more information

If you have any questions or comments about this advisory:


Configuration

📅 Schedule: "" (UTC).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box.

This PR has been generated by WhiteSource Renovate. View repository job log here.

@mdnorman mdnorman merged commit 9a13f8f into master Jun 23, 2021
@mdnorman mdnorman deleted the renovate/npm-object-path-vulnerability branch June 23, 2021 03:30
mdnorman added a commit that referenced this pull request Oct 9, 2021
chore(deps): update dependency pretty-quick to v3
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants