search

angular-redux / ng-redux

Angular bindings for Redux
MIT License
1.16k stars 177 forks source link

the published version of 4.4.1 depends on a vulnerable version of lodash (4.17.13) #234

Closed joekrump closed 3 years ago

joekrump commented 4 years ago

For some reason, the package.json file that is published depends on an exact version of lodash (4.17.13) screenshot below which is vulnerable to https://github.com/advisories/GHSA-p6mc-m468-83gw and which does not match up with what's specified in this project's package.json file which specifies (^4.17.13).

Screen Shot 2020-08-18 at 4 36 11 PM

My proposal is to publish a new patch version 4.4.2 which should have a package.json file that matches the one in this repo. Also, ping me and let me know if I can help or provide more information.

oliviernt commented 3 years ago

I've just release v4.4.2with lodash v4.17.20 which fixes CVE-2020-8203