Skip to content

Commit

Permalink
fix: use @snyk/update-notifier instead of update-notifier
Browse files Browse the repository at this point in the history
Using a forked version of update-notifier to fix a
prototype pollution in its dependency dot-prop present
in versions < 5.1.0
  • Loading branch information
jjmschofield authored and lili2311 committed Jan 31, 2020
1 parent 93845d9 commit b74bbe2
Show file tree
Hide file tree
Showing 3 changed files with 3 additions and 3 deletions.
2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@
"@snyk/dep-graph": "1.13.1",
"@snyk/gemfile": "1.2.0",
"@snyk/snyk-cocoapods-plugin": "2.0.1",
"@snyk/update-notifier": "^2.5.1-rc1",
"@types/agent-base": "^4.2.0",
"@types/restify": "^4.3.6",
"abbrev": "^1.1.1",
Expand Down Expand Up @@ -97,7 +98,6 @@
"strip-ansi": "^5.2.0",
"tempfile": "^2.0.0",
"then-fs": "^2.0.0",
"update-notifier": "^2.5.0",
"uuid": "^3.3.2",
"wrap-ansi": "^5.1.0"
},
Expand Down
2 changes: 1 addition & 1 deletion src/lib/updater.ts
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
import * as updateNotifier from 'update-notifier';
import * as updateNotifier from '@snyk/update-notifier';
import * as fs from 'fs';
import * as p from 'path';

Expand Down
2 changes: 1 addition & 1 deletion test/updater.test.js
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ const updateCheck = require('../src/lib/updater').updateCheck;
const fs = require('fs');
const p = require('path');
const sinon = require('sinon').createSandbox();
const updateNotifier = require('update-notifier');
const updateNotifier = require('@snyk/update-notifier');

// Fake location of the package.json file and verify the code behaves well
test('missing package.json', (t) => {
Expand Down

0 comments on commit b74bbe2

Please sign in to comment.