Closed xiniria closed 3 years ago
I just realized that the Snyk bot already created a PR for that: #98
Indeed it created, but thank you so much for calling this out and making sure I track it! You're a security hero, sir! 🤗 💜
@lirantal The publish job failed on the CI so there is no new version after this PR, could you check what happened?
Yep, I know. It's because the lockfile didn't get properly updated. I am on a temporary macbook right now so I don't have a clone of the project and the environment to fix it. If you wanted to submit a PR that updates the lockfile I'll gladly merge it, as I'll only get to this later next week.
Done in #100.
Expected Behavior
When using
npq
(your own tool! 😋) to installlockfile-lint
, it pointed out that it has 1 vulnerability, according to Snyk's Vuln DB. Actually this vulnerability is a prototype pollution iny18n@4.0.0
, which is a dependency ofyargs@15.4.1
. It is a known vulnerability and it has been fixed a few weeks ago. Updatingyargs
to the latest version (16.1.1) updatesy18n
to version 5.0.5 and fixes the issue.Current Behavior
Vulnerability in dependency.
Possible Solution
Update
yargs
to version 16.1.1.Your Environment