Closed jwmunn closed 4 years ago
This pull request has been mentioned on Foundation Open Source Community. There might be relevant details there:
https://foundation.discourse.group/t/security-vulnerability-in-inky/2774/1
@DanielRuf since the issue was closed, do you know if there is a timeline on testing and implementing this update? Is there a way I could help with that?
We will update this separately in the future as described at https://github.com/foundation/inky/issues/120#issuecomment-642795421.
@jwmunn I spent most of the day updating dependencies, fixing vulnerabilities and tests. Please give v1.4.1 a shot.
@joeworkman Awesome! Thanks for the update, I'll upgrade and report back.
Fixes #120
Dependabot has recently been natively pulled into Github and is flagging
braces
package as a security vulnerability. This is a dependency ofvinyl-fs
and has been flagged in issue #120Proposal
Update
vinyl-fs
to3.0.3
. This updates theglob-stream
dependency to6.1.0
, which removes the dependency onmicromatch
andbraces
which has the vulnerability.Other uses of
braces
are using newer versions 👍Context
Issue #120
Additional context:
Security vulnerability
Packages affected