Skip to content
This repository has been archived by the owner on Jan 18, 2024. It is now read-only.

Commit

Permalink
[plist] Update xmldom for security reasons (#4571)
Browse files Browse the repository at this point in the history
[Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom · CVE-2022-37616 · GitHub Advisory Database](GHSA-9pgh-qqpf-7wqj)

`@xmldom/xmldom` has already been patched:

[fix: Avoid iterating over prototype properties by karfau · Pull Request #437 · xmldom/xmldom](xmldom/xmldom#437)

newer versions exist but this is the latest patch version and there shoudln't be any breaking changes

`yarn build` and `yarn test`
  • Loading branch information
mfulton26 committed Oct 28, 2022
1 parent 86c1f4e commit 68fdef1
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 5 deletions.
2 changes: 1 addition & 1 deletion packages/plist/package.json
Expand Up @@ -26,7 +26,7 @@
"build"
],
"dependencies": {
"@xmldom/xmldom": "~0.7.0",
"@xmldom/xmldom": "~0.7.6",
"base64-js": "^1.2.3",
"xmlbuilder": "^14.0.0"
},
Expand Down
8 changes: 4 additions & 4 deletions yarn.lock
Expand Up @@ -4308,10 +4308,10 @@
dependencies:
tslib "^1.9.3"

"@xmldom/xmldom@~0.7.0":
version "0.7.2"
resolved "https://registry.yarnpkg.com/@xmldom/xmldom/-/xmldom-0.7.2.tgz#d920079e66806b2626b5311955f6a7c4bed1cba8"
integrity sha512-t/Zqo0ewes3iq6zGqEqJNUWI27Acr3jkmSUNp6E3nl0Z2XbtqAG5XYqPNLdYonILmhcxANsIidh69tHzjXtuRg==
"@xmldom/xmldom@~0.7.6":
version "0.7.6"
resolved "https://registry.yarnpkg.com/@xmldom/xmldom/-/xmldom-0.7.6.tgz#6f55073fa73e65776bd85826958b98c8cd1457b5"
integrity sha512-HHXP9hskkFQHy8QxxUXkS7946FFIhYVfGqsk0WLwllmexN9x/+R4UBLvurHEuyXRfVEObVR8APuQehykLviwSQ==

"@xtuc/ieee754@^1.2.0":
version "1.2.0"
Expand Down

0 comments on commit 68fdef1

Please sign in to comment.