search

mateodelnorte / symlink-meta-dependencies

symlink all of a project's dependencies which appear in the project's .meta file
1 stars 4 forks source link

chore(deps): update dependency lodash to 4.17.19 [security] #15

Closed renovate[bot] closed 3 years ago

renovate[bot] commented 3 years ago

WhiteSource Renovate

This PR contains the following updates:

Package Change
lodash 4.17.15 -> 4.17.19

GitHub Vulnerability Alerts

CVE-2020-8203

Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The function zipObjectDeep allows a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires zipping objects based on user-provided property arrays.

This vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.

Configuration

:date: Schedule: "" (UTC).

:vertical_traffic_light: Automerge: Enabled.

:recycle: Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

:no_bell: Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by WhiteSource Renovate. View repository job log here.

mateodelnorte commented 3 years ago

:tada: This PR is included in version 1.2.5 :tada:

The release is available on:

Your semantic-release bot :package::rocket: