search

lirantal / lockfile-lint

Lint an npm or yarn lockfile to analyze and detect security issues
Apache License 2.0
781 stars 35 forks source link

Vulnerability in y18n (prototype pollution) #99

Closed xiniria closed 3 years ago

xiniria commented 3 years ago

Expected Behavior

When using npq (your own tool! 😋) to install lockfile-lint, it pointed out that it has 1 vulnerability, according to Snyk's Vuln DB. Actually this vulnerability is a prototype pollution in y18n@4.0.0, which is a dependency of yargs@15.4.1. It is a known vulnerability and it has been fixed a few weeks ago. Updating yargs to the latest version (16.1.1) updates y18n to version 5.0.5 and fixes the issue.

Current Behavior

Vulnerability in dependency.

Possible Solution

Update yargs to version 16.1.1.

Your Environment

xiniria commented 3 years ago

I just realized that the Snyk bot already created a PR for that: #98

lirantal commented 3 years ago

Indeed it created, but thank you so much for calling this out and making sure I track it! You're a security hero, sir! 🤗 💜

xiniria commented 3 years ago

@lirantal The publish job failed on the CI so there is no new version after this PR, could you check what happened?

lirantal commented 3 years ago

Yep, I know. It's because the lockfile didn't get properly updated. I am on a temporary macbook right now so I don't have a clone of the project and the environment to fix it. If you wanted to submit a PR that updates the lockfile I'll gladly merge it, as I'll only get to this later next week.

xiniria commented 3 years ago

Done in #100.