Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: #788 fix kind-of vulnerabilities #829

Merged
merged 1 commit into from Apr 6, 2020

Conversation

vuhuucuong
Copy link
Contributor

fixes #788
Use kind-of ^6.0.3 as people currently doing in here jonschlinkert/kind-of#31

Copy link
Contributor

@duong-se duong-se left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@vuhuucuong vuhuucuong merged commit dfdf630 into master Apr 6, 2020
@vuhuucuong vuhuucuong deleted the chore/788-fix-kind-of-vulnerabilities branch April 6, 2020 10:33
@mgk
Copy link

mgk commented Apr 9, 2020

Just curious, did you just edit yarn.lock directly or run yarn. On one of my projects when I attempted what you did here running yarn after editing yarn.lock as you have here, yarn spat out a warning and put back the old versions.

@vuhuucuong
Copy link
Contributor Author

@mgk no, you shouldn't edit yarn.lock directly, you should use https://classic.yarnpkg.com/en/docs/selective-version-resolutions/
Basically, It allows us to override the version of the sub-dependency, which means the dependency of our dependency

@mgk
Copy link

mgk commented Apr 9, 2020

Yeah, that's been my mantra too (not editing yarn.lock). Thanks very much for the pointer.

nphivu414 pushed a commit that referenced this pull request Apr 29, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Address security vulnerability in kind-of package
4 participants