search

firstandthird / load-grunt-config

Grunt plugin that lets you break up your Gruntfile config by task
firstandthird.github.io/load-grunt-config/
MIT License
374 stars 64 forks source link

dependency js-yaml update, high severity vulnerability #180

Closed tzahari closed 5 years ago

tzahari commented 5 years ago

Please update js-yaml cause npm audit found this issue:

┌───────────────┬──────────────────────────────────────────────────────────────┐ │ Moderate │ Denial of Service │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ js-yaml │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ >=3.13.0 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ load-grunt-config [dev] │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ load-grunt-config > js-yaml │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://npmjs.com/advisories/788 │ └───────────────┴──────────────────────────────────────────────────────────────┘ ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ High │ Code Injection │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ js-yaml │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ >=3.13.1 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ load-grunt-config [dev] │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ load-grunt-config > js-yaml │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://npmjs.com/advisories/813 │ └───────────────┴──────────────────────────────────────────────────────────────┘ Thank you

Nnamdi101 commented 5 years ago

It looks like this is fixed in version 2.0.0-rc1. Does anyone know when this will be released?

SolomoN-ua commented 5 years ago

Package version 2.0.0-rc1 is already available on npm repo.

SolomoN-ua commented 5 years ago

Btw, also just published two new versions: 2.0.0 - release version instead of RC1 3.0.0-rc1 - RC version with newer load-grunt-tasks and support of Node >= 8