Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update places with minimist 1.2.5 #25557

Merged
merged 1 commit into from
Apr 2, 2024
Merged

update places with minimist 1.2.5 #25557

merged 1 commit into from
Apr 2, 2024

Conversation

kisantia
Copy link
Contributor

@kisantia kisantia commented Apr 2, 2024

The new pipelines flagged minimist 1.2.5 needing to be updated because of this vulnerability: GHSA-xvch-5gv4-984h

It was previously dismissed as the vulnerability not being used, I figured might as well update it since it's a small change and only in the sample code.

@corivera
Copy link
Member

corivera commented Apr 2, 2024

Will these lock changes potentially get overwritten in subsequent builds? Should these go in a package.json file instead?

@kisantia
Copy link
Contributor Author

kisantia commented Apr 2, 2024

Will these lock changes potentially get overwritten in subsequent builds? Should these go in a package.json file instead?

minimist is an indirect dependency of other packages, so it isn't specified in any of these package.jsons. Since these yarn.lock files have been updated for minimist@^1.2.5 to resolve to version 1.2.8, it shouldn't get updated when yarn is run, unless the package that depends on it gets updated to need a higher version.

@coveralls
Copy link

Pull Request Test Coverage Report for Build 8530260463

Details

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage remained the same at 41.757%

Totals Coverage Status
Change from base Build 8511640437: 0.0%
Covered Lines: 30827
Relevant Lines: 69082

💛 - Coveralls

@kisantia kisantia merged commit ed4368a into main Apr 2, 2024
12 checks passed
@kisantia kisantia deleted the kisantia/updateMinimist branch April 2, 2024 23:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants