search

bower / bower

A package manager for the web
bower.io
MIT License
14.99k stars 1.85k forks source link

Fixes #2616: Update insecure minimist dependency version #2617

Open IceCreamYou opened 2 years ago

IceCreamYou commented 2 years ago

Fixes this security advisory: https://github.com/advisories/GHSA-xvch-5gv4-984h

I reviewed the commits between minimist versions and didn't see anything that looked like it would cause compatibility issues with the one place this dependency is used here, but I did not test exhaustively that the upgrade did not break things.

amark-axcient commented 2 years ago

@IceCreamYou the contributing guidelines specified a feature branch in the fork, not sure if the maintainers will consider master as a feature branch? Maintainers: Is there a standard practice for testing dependency updates thoroughly? I'm guessing you're looking for more than running the tests?

IceCreamYou commented 2 years ago

The branch used in my fork makes no difference here. Feature branches are recommended because that'd be needed if I had multiple PRs open at once.

amark-axcient commented 2 years ago

semantics, they specifically ask that contributors create a new topic branch and I was trying to determine if that could be why this PR isn't being reviewed