search

ExtensionEngine / tailor

Content authoring platform
MIT License
31 stars 10 forks source link

[Snyk] Security upgrade lerna from 4.0.0 to 5.0.0 #969

Closed snyk-bot closed 2 years ago

snyk-bot commented 2 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: lerna The new version differs by 18 commits.
  • f69480e chore(release): v5.0.0
  • 8d39927 fix!: replace npm-lifecycle with @ npmcli/run-script (#3134)
  • 7b83774 chore: upgrade pacote to the latest version (#3137)
  • f1c10a4 fix: replace read-package-tree with @ npmcli/arborist (#3133)
  • 5b2228f fix!: drop support for EOL node versions prior to 14 (#3136)
  • ff7c961 chore: inline the temp-write dep so we can bump uuid (#3135)
  • b7f883b chore: add local npm registry for full e2e testing and local publish (#3132)
  • 2b3b191 fix: resolve most dependency audit issues (#3127)
  • 76bb99d docs(readme): change wording in stewardship text
  • 1dc33b8 docs(chore): update readme
  • 79fbbb1 docs(chore): update maintenance message saying lerna lives
  • 8b99493 docs: add maintenance note to README (#3092)
  • a47fc29 chore(ci): Install npm@7
  • 5250e9f chore(ci): Add Node v14 to matrix
  • 6b36286 chore: Remove Travis
  • 326a6a2 chore: npm audit --fix
  • c019815 chore(lockfile): Sync workspace versions
  • 6cb8ab2 docs: Change link to Snyk (#2779)
See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

underscope commented 2 years ago

See #970