search

sourcegraph / javascript-typescript-langserver

JavaScript and TypeScript code intelligence through the Language Server Protocol
https://sourcegraph.com
Apache License 2.0
792 stars 72 forks source link

fix(deps): update dependency lodash to v4.17.11 [security] #568

Closed renovate[bot] closed 5 years ago

renovate[bot] commented 5 years ago

This PR contains the following updates:

Package Type Update New value References Sourcegraph
lodash dependencies patch ^4.17.4 homepage, source code search for "lodash"

GitHub Vulnerability Alerts

CVE-2018-16487

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Release Notes

lodash/lodash ### [`v4.17.11`](https://togithub.com/lodash/lodash/compare/4.17.10...4.17.11) [Compare Source](https://togithub.com/lodash/lodash/compare/4.17.10...4.17.11)

Renovate configuration

:date: Schedule: "" in timezone America/Los_Angeles.

:vertical_traffic_light: Automerge: Disabled by config. Please merge this manually once you are satisfied.

:recycle: Rebasing: Whenever PR becomes conflicted, or if you modify the PR title to begin with "rebase!".

:no_bell: Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Renovate Bot. View repository job log here.

codecov-io commented 5 years ago

Codecov Report

Merging #568 into master will not change coverage. The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##           master     #568   +/-   ##
=======================================
  Coverage   83.09%   83.09%           
=======================================
  Files          15       15           
  Lines        2058     2058           
  Branches      423      423           
=======================================
  Hits         1710     1710           
  Misses        346      346           
  Partials        2        2

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update 3ff36e5...8128b13. Read the comment docs.

sourcegraph-bot commented 5 years ago

:tada: This PR is included in version 2.11.3 :tada:

The release is available on:

Your semantic-release bot :package::rocket: