search

javanile / yamlinc

Compose multiple YAML files into one with $include tag. Split Swagger/OpenAPI into multiple YAML files.
MIT License
114 stars 22 forks source link

Set exact version of package 'colors' #32

Open novalu opened 2 years ago

novalu commented 2 years ago

The infinite loop introduced in the code (of colors package version 1.4.2) will keep running indefinitely; printing the gibberish non-ASCII character sequence endlessly on the console for any applications that use 'colors.'

More info about colors package issue is here: https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/

Temporary solution is to define exact version of package colors, i.e. 1.3.3 or 1.4.0 instead of ^1.3.3 (which install last minor/patch (compromised) version 1.4.2. This pull requests changes version from ^1.3.3 to 1.3.3.