Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

upgrade randomatic for yarn.lock vulnerability #262

Closed
wants to merge 2 commits into from

Conversation

ElreyB
Copy link
Contributor

@ElreyB ElreyB commented Oct 31, 2018

@parkerziegler If I understood the vulnerability alert correctly it is a dependency in the yarn.lock file (randomatic) that needed to be upgrade. I ran yarn upgrade to fix this.

@ryan-roemer
Copy link
Member

Side note: the PR has upgraded using a more modern yarn that also adds integrity sums like:

integrity sha512-cuAuTTIQ9RqcFRJ/Y8PvTh+paepNcaGxwQwjIDRWPXmzzyAeCO4KqS9ikMvq0MCbRk6GlYKwfzStrcP3/jSL8g==

This is definitely a good thing, but maybe we add a note wherever we talk about using / installing yarn to make sure to use yarn@1.11+ (it was 1.10 or something that introduced the hashes0.

@ElreyB ElreyB force-pushed the chore/elrey-randomatic-upgrade branch from 02ef9aa to 45f2afe Compare November 14, 2018 17:31
@parkerziegler
Copy link
Contributor

@ElreyB @ryan-roemer Our security issue appears to have gone away after our yarn upgrade introduced in #263. So I'm going to close this PR and, in working on some updated docs for Contributing, make sure to make note of our yarn requirements.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants