dependabot-preview[bot]
commented
4 years ago We've just been alerted that this update fixes a security vulnerability:
Sourced from The GitHub Security Advisory Database.
Low severity vulnerability that affects npm
Arbitrary File Overwrite
Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a
servebinary, any subsequent installs of packages that also create aservebinary would overwrite the previousservebinary.This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
Thank you to Daniel Ruf for reporting the issue!
Further information: npm blog post
Affected versions: ["< 6.13.4"]
Bumps npm from 6.1.0 to 6.13.4.
Release notes
*Sourced from [npm's releases](https://github.com/npm/cli/releases).* > ## v6.13.4 > ## 6.13.4 (2019-12-11) > > ## BUGFIXES > > * [`320ac9aee`](https://github.com/npm/cli/commit/320ac9aeeafd11bb693c53b31148b8d10c4165e8) [npm/bin-links#12](https://github-redirect.dependabot.com/npm/bin-links/pull/12) [npm/gentle-fs#7](https://github-redirect.dependabot.com/npm/gentle-fs/pull/7) Do not remove global bin/man links inappropriately ([@isaacs](https://github.com/isaacs)) > > ## DEPENDENCIES > > * [`52fd21061`](https://github.com/npm/cli/commit/52fd21061ff8b1a73429294620ffe5ebaaa60d3e) `gentle-fs@2.3.0` ([@isaacs](https://github.com/isaacs)) > * [`d06f5c0b0`](https://github.com/npm/cli/commit/d06f5c0b0611c43b6e70ded92af24fa5d83a0f48) `bin-links@1.1.6` ([@isaacs](https://github.com/isaacs)) > > ## v6.13.3 > ## 6.13.3 (2019-12-09) > > ### DEPENDENCIES > > * [`19ce061a2`](https://github.com/npm/cli/commit/19ce061a2ee165d8de862c8f0f733c222846b9e1) `bin-links@1.1.5` Properly normalize, sanitize, and verify `bin` entries in `package.json`. > * [`59c836aae`](https://github.com/npm/cli/commit/59c836aae8d0104a767e80c540b963c91774012a) `npm-packlist@1.4.7` > * [`fb4ecd7d2`](https://github.com/npm/cli/commit/fb4ecd7d2810b0b4897daaf081a5e2f3f483b310) `pacote@9.5.11` > * [`5f33040`](https://github.com/npm/pacote/commit/5f3304028b6985fd380fc77c4840ff12a4898301) [#476](https://github-redirect.dependabot.com/npm/cli/issues/476) [npm/pacote#22](https://github-redirect.dependabot.com/npm/pacote/issues/22) [npm/pacote#14](https://github-redirect.dependabot.com/npm/pacote/issues/14) fix: Do not drop perms in git when not root ([isaacs](https://github.com/isaacs), [@darcyclarke](https://github.com/darcyclarke)) > * [`6f229f7`](https://github.com/npm/pacote/6f229f78d9911b4734f0a19c6afdc5454034c759) sanitize and normalize package bin field ([isaacs](https://github.com/isaacs)) > * [`1743cb339`](https://github.com/npm/cli/commit/1743cb339767e86431dcd565c7bdb0aed67b293d) `read-package-json@2.1.1` > > ## v6.13.2 > ## 6.13.2 (2019-12-03) > > ### BUG FIXES > > * [`4429645b3`](https://github.com/npm/cli/commit/4429645b3538e1cda54d8d1b7ecb3da7a88fdd3c) [#546](https://github-redirect.dependabot.com/npm/cli/pull/546) fix docs target typo ([@richardlau](https://github.com/richardlau)) > * [`867642942`](https://github.com/npm/cli/commit/867642942bec69bb9ab71cff1914fb6a9fe67de8) [#142](https://github-redirect.dependabot.com/npm/cli/pull/142) fix(packageRelativePath): fix 'where' for file deps ([@larsgw](https://github.com/larsgw)) > * [`d480f2c17`](https://github.com/npm/cli/commit/d480f2c176e6976b3cca3565e4c108b599b0379b) [#527](https://github-redirect.dependabot.com/npm/cli/pull/527) Revert "windows: Add preliminary WSL support for npm and npx" ([@craigloewen-msft](https://github.com/craigloewen-msft)) > * [`e4b97962e`](https://github.com/npm/cli/commit/e4b97962e5fce0d49beb541ce5a0f96aee0525de) [#504](https://github-redirect.dependabot.com/npm/cli/pull/504) remove unnecessary package.json read when reading shrinkwrap ([@Lighting-Jack](https://github.com/Lighting-Jack)) > * [`1c65d26ac`](https://github.com/npm/cli/commit/1c65d26ac9f10ac0037094c207d216fbf0e969bf) [#501](https://github-redirect.dependabot.com/npm/cli/pull/501) fix(fund): open url for string shorthand ([@ruyadorno](https://github.com/ruyadorno)) > * [`ae7afe565`](https://github.com/npm/cli/commit/ae7afe56504dbffabf9f73d55b6dac1e3e9fed4a) [#263](https://github-redirect.dependabot.com/npm/cli/pull/263) Don't log error message if git tagging is disabled ([@woppa684](https://github.com/woppa684)) > * [`4c1b16f6a`](https://github.com/npm/cli/commit/4c1b16f6aecaf78956b9335734cfde2ac076ee11) [#182](https://github-redirect.dependabot.com/npm/cli/pull/182) Warn the user that it is uninstalling npm-install ([@Hoidberg](https://github.com/Hoidberg)) > > ## v6.13.1 > ## 6.13.1 (2019-11-18) > > ### BUG FIXES > > * [`938d6124d`](https://github.com/npm/cli/commit/938d6124d6d15d96b5a69d0ae32ef59fceb8ceab) [#472](https://github-redirect.dependabot.com/npm/cli/pull/472) fix(fund): support funding string shorthand ([@ruyadorno](https://github.com/ruyadorno)) > * [`b49c5535b`](https://github.com/npm/cli/commit/b49c5535b7c41729a8d167b035924c3c66b36de0) [#471](https://github-redirect.dependabot.com/npm/cli/pull/471) should not publish tap-snapshot folder ([@ruyadorno](https://github.com/ruyadorno)) > * [`3471d5200`](https://github.com/npm/cli/commit/3471d5200217bfa612b1a262e36c9c043a52eb09) [#253](https://github-redirect.dependabot.com/npm/cli/pull/253) Add preliminary WSL support for npm and npx ([@infinnie](https://github.com/infinnie)) > * [`3ef295f23`](https://github.com/npm/cli/commit/3ef295f23ee1b2300abf13ec19e935c47a455179) [#486](https://github-redirect.dependabot.com/npm/cli/pull/486) print quick audit report for human output ([@isaacs](https://github.com/isaacs)) > > ### TESTING > > * [`dbbf977ac`](https://github.com/npm/cli/commit/dbbf977acd1e74bcdec859c562ea4a2bc0536442) [#278](https://github-redirect.dependabot.com/npm/cli/pull/278) added workflow to trigger and run benchmarks ([@mikemimik](https://github.com/mikemimik)) > ... (truncated)Changelog
*Sourced from [npm's changelog](https://github.com/npm/cli/blob/latest/CHANGELOG.md).* > ## 6.13.4 (2019-12-11) > > ## BUGFIXES > > * [`320ac9aee`](https://github.com/npm/cli/commit/320ac9aeeafd11bb693c53b31148b8d10c4165e8) > [npm/bin-links#12](https://github-redirect.dependabot.com/npm/bin-links/pull/12) > [npm/gentle-fs#7](https://github-redirect.dependabot.com/npm/gentle-fs/pull/7) > Do not remove global bin/man links inappropriately > ([@isaacs](https://github.com/isaacs)) > > ## DEPENDENCIES > > * [`52fd21061`](https://github.com/npm/cli/commit/52fd21061ff8b1a73429294620ffe5ebaaa60d3e) > `gentle-fs@2.3.0` > ([@isaacs](https://github.com/isaacs)) > * [`d06f5c0b0`](https://github.com/npm/cli/commit/d06f5c0b0611c43b6e70ded92af24fa5d83a0f48) > `bin-links@1.1.6` > ([@isaacs](https://github.com/isaacs)) > > ## 6.13.3 (2019-12-09) > > ### DEPENDENCIES > > * [`19ce061a2`](https://github.com/npm/cli/commit/19ce061a2ee165d8de862c8f0f733c222846b9e1) > `bin-links@1.1.5` Properly normalize, sanitize, and verify `bin` entries > in `package.json`. > * [`59c836aae`](https://github.com/npm/cli/commit/59c836aae8d0104a767e80c540b963c91774012a) > `npm-packlist@1.4.7` > * [`fb4ecd7d2`](https://github.com/npm/cli/commit/fb4ecd7d2810b0b4897daaf081a5e2f3f483b310) > `pacote@9.5.11` > * [`5f33040`](https://github.com/npm/pacote/commit/5f3304028b6985fd380fc77c4840ff12a4898301) > [#476](https://github-redirect.dependabot.com/npm/cli/issues/476) > [npm/pacote#22](https://github-redirect.dependabot.com/npm/pacote/issues/22) > [npm/pacote#14](https://github-redirect.dependabot.com/npm/pacote/issues/14) fix: Do not > drop perms in git when not root ([isaacs](https://github.com/isaacs), > [@darcyclarke](https://github.com/darcyclarke)) > * [`6f229f7`](https://github.com/npm/pacote/6f229f78d9911b4734f0a19c6afdc5454034c759) > sanitize and normalize package bin field > ([isaacs](https://github.com/isaacs)) > * [`1743cb339`](https://github.com/npm/cli/commit/1743cb339767e86431dcd565c7bdb0aed67b293d) > `read-package-json@2.1.1` > > > ## 6.13.2 (2019-12-03) > > ### BUG FIXES > > * [`4429645b3`](https://github.com/npm/cli/commit/4429645b3538e1cda54d8d1b7ecb3da7a88fdd3c) > [#546](https://github-redirect.dependabot.com/npm/cli/pull/546) > fix docs target typo > ... (truncated)Commits
- [`fd29398`](https://github.com/npm/cli/commit/fd29398f6904010493acc7c3d96af38178f94b97) 6.13.4 - [`f2aca36`](https://github.com/npm/cli/commit/f2aca364a5bb7434fdc6f8be2e98f583bdfe92f2) docs: changelog for 6.13.4 - [`320ac9a`](https://github.com/npm/cli/commit/320ac9aeeafd11bb693c53b31148b8d10c4165e8) Do not remove global bin/man links inappropriately - [`d06f5c0`](https://github.com/npm/cli/commit/d06f5c0b0611c43b6e70ded92af24fa5d83a0f48) bin-links@1.1.6 - [`52fd210`](https://github.com/npm/cli/commit/52fd21061ff8b1a73429294620ffe5ebaaa60d3e) gentle-fs@2.3.0 - [`45482c2`](https://github.com/npm/cli/commit/45482c25c0d169179fe56d1877e60361993cc8bd) 6.13.3 - [`118bc96`](https://github.com/npm/cli/commit/118bc96bb7d4e215c0dd9efbcbcb5728701c0011) docs: changelog for 6.13.3 - [`1743cb3`](https://github.com/npm/cli/commit/1743cb339767e86431dcd565c7bdb0aed67b293d) read-package-json@2.1.1 - [`fb4ecd7`](https://github.com/npm/cli/commit/fb4ecd7d2810b0b4897daaf081a5e2f3f483b310) pacote@9.5.11 - [`59c836a`](https://github.com/npm/cli/commit/59c836aae8d0104a767e80c540b963c91774012a) npm-packlist@1.4.7 - Additional commits viewable in [compare view](https://github.com/npm/cli/compare/v6.1.0...v6.13.4)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired)