chore: upgrade lerna to fix CVE with tar dependency

aws / jsii

jsii allows code in any language to naturally interact with JavaScript classes. It is the technology that enables the AWS Cloud Development Kit to deliver polyglot libraries from a single codebase!

https://aws.github.io/jsii

Apache License 2.0

2.59k stars 242 forks source link

chore: upgrade lerna to fix CVE with tar dependency #4555

Closed mrgrain closed 5 days ago

mrgrain commented 5 days ago

See https://github.com/advisories/GHSA-f5x3-32g6-xq36 The affected version of tar is only used in build tooling, i.e. no risk to published packages.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

mergify[bot] commented 5 days ago

Thank you for contributing! :heart: I will now look into making sure the PR is up-to-date, then proceed to try and merge it!

mergify[bot] commented 5 days ago

Merging (with squash)...