Skip to content

Conversation

@virkt25
Copy link
Contributor

@virkt25 virkt25 commented May 1, 2018

Description

Updates a 0.x.y dependency. Fixes #1304 (prototype pollution security issue).

Motivation and Context

Downstream projects are getting flagged by Snyk as impacted by the issue.
Fixes #1304

How Has This Been Tested?

deep-extend 0.5.1 was a security fix release as per their changelog.

Screenshots (if appropriate):

Types of changes

  • No code changes (changes to documentation, CI, metadata, etc)
  • Dependency changes (any modification to dependencies in package.json)
  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have added tests to cover my changes.
  • All new and existing tests passed.

Must update a `0.x.y` dependency. Fixes #1304 (prototype pollution security issue).
@webron webron requested a review from shockey May 1, 2018 18:09
@shockey shockey added this to the May 4, 2018 milestone May 1, 2018
@shockey shockey merged commit 5b0959e into swagger-api:master May 1, 2018
@shockey
Copy link
Contributor

shockey commented May 1, 2018

thanks @virkt25!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Prototype Pollution Vulnerability

2 participants