Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

move dot-prop to > 5.1.0 #3

Merged
merged 1 commit into from
May 15, 2020

Conversation

iamcdonald
Copy link
Contributor

@iamcdonald iamcdonald commented Mar 12, 2020

This is used across a few other packages and currently relies on a dot-prop version that has the following security vulnerability https://nvd.nist.gov/vuln/detail/CVE-2020-8116

This just ups the dot-prop version to >5.1.0.

I've ran the tests and everything looks fine.

This is dependent on being rebased after #4 has been merged.

@vv-varun
Copy link

@stevemao - could you please approve this pull request... This is really important as it resolves a security vulnerability..
Let me know if I can help in any way

@stevemao
Copy link
Owner

Sorry just saw this. CI failed. Looks like this is still on an old version of node. Could you bump the version of node too? Thanks

@iamcdonald
Copy link
Contributor Author

iamcdonald commented May 15, 2020

Hi folks,

I’ve raised another PR to fix the tests (it’s an outstanding issue rather than something caused by this version bump).

#4

@stevemao If we could merge that first I’ll rebase this PR and then there’ll be no test failures.

@stevemao stevemao merged commit 5ad9660 into stevemao:master May 15, 2020
@stevemao
Copy link
Owner

Should this be a major bump or minor?

@iamcdonald
Copy link
Contributor Author

I would say minor or bugfix Given that it’s not actually changing the api.

@stevemao
Copy link
Owner

@iamcdonald I had to update nodejs versions to make it work. So I published as major release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants