Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update @11ty/eleventy js-yaml nyc to fix npm audit vulnerabilities #3878

Closed
wants to merge 4 commits into from
Closed

Update @11ty/eleventy js-yaml nyc to fix npm audit vulnerabilities #3878

wants to merge 4 commits into from

Conversation

narayananramu
Copy link

@narayananramu narayananramu commented Apr 17, 2019 •
edited by plroebuck
Loading

Description of the Change

Update the below dependencies to address npm security advisories

@11ty/eleventy -> 0.8.2
js-yaml -> @3.13.1
nyc -> 14.0.0

Alternate Designs

N/A

Why should this be in core?

N/A

Benefits

Improved security

Possible Drawbacks

None

Applicable issues

Fixes #3880

@jsf-clabot
Copy link

jsf-clabot commented Apr 17, 2019 •
edited
Loading

CLA assistant check
All committers have signed the CLA.

@coveralls
Copy link

coveralls commented Apr 17, 2019 •
edited
Loading

Coverage Status

Coverage increased (+0.03%) to 91.739% when pulling 1bfc553 on narayananramu:issue/3876 into 0d9d4a3 on mochajs:master.

markowsiak
markowsiak approved these changes Apr 17, 2019
View reviewed changes
Copy link
Contributor

@markowsiak markowsiak left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for contributing 👍

@markowsiak markowsiak mentioned this pull request Apr 17, 2019
Merged
plroebuck
plroebuck reviewed Apr 17, 2019
View reviewed changes
package.json Outdated
@@ -512,7 +512,7 @@
"glob": "7.1.3",
"growl": "1.10.5",
"he": "1.2.0",
"js-yaml": "3.13.0",
"js-yaml": "^3.13.1",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fix for this already merged

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it be possible to publish a new release since the vulnerability is high? Thanks

@plroebuck plroebuck added the area: security involving vulnerabilities label Apr 17, 2019
@plroebuck
Copy link
Contributor

plroebuck commented Apr 17, 2019 •
edited
Loading

@Munter care to weigh in on eleventy update?

@plroebuck
Copy link
Contributor

plroebuck commented Apr 17, 2019 •
edited
Loading

nyc-14.0.0 has breaking changes; someone with more experience with this package will need to review.

@dewwwald dewwwald mentioned this pull request Apr 18, 2019
Closed
4 tasks
@dewwwald
Copy link

dewwwald commented Apr 18, 2019 •
edited
Loading

Thank you for fixing.

People are getting rowdy on the thread that is referenced. Commenting here to bump up to the maintainers inbox, consider merging and opening a separate thread for the breaking changes in eleventy.

@Bamieh
Copy link
Contributor

Bamieh commented Apr 18, 2019

According to the nyc changelog we should not be affected by the breaking changes. We can upgrade safely (https://github.com/istanbuljs/nyc/blob/master/CHANGELOG.md#1400-2019-04-15)

@welljsjs
Copy link

welljsjs commented Apr 18, 2019 •
edited
Loading

This has been merged in #3877. This seems to be a duplicate. v6.1.4 (just released) comes with updated dependencies.

@Bamieh
Copy link
Contributor

Bamieh commented Apr 18, 2019

@welljsjs this PR updates nyc and @11ty/eleventy which are not updated on master branch.

@welljsjs
Copy link

@Bamieh True. Sorry about the disturbance, I got it wrong.

Bamieh
Bamieh approved these changes Apr 19, 2019
View reviewed changes
Copy link
Contributor

@Bamieh Bamieh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Need to resolve conflict in lock file 1st.

@plroebuck
Copy link
Contributor

@Munter, ping! Waiting on your approval before updating eleventy...

@juergba
Copy link
Contributor

juergba commented Jun 6, 2019

@narayananramu sorry, I apologize.
closed, see #3939.

@juergba juergba closed this Jun 6, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@loayg loayg loayg left review comments

@plroebuck plroebuck plroebuck left review comments

@Bamieh Bamieh Bamieh approved these changes

@markowsiak markowsiak markowsiak approved these changes

@outsideris outsideris outsideris approved these changes

Assignees
No one assigned
Labels
area: security involving vulnerabilities
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Vulnerability Advisory flaggs 1 high vulnerability in js-yaml for mocha@6.1.3