fix: lodash CVE-2021-41720, ansi-regex CVE-2021-3807, set-value CVE-2… #13

nmccready · 2021-10-07T20:49:46Z

lodash CVE-2021-41720
ansi-regex CVE-2021-3807
set-value CVE-021-23440

JBartscher · 2022-07-26T14:35:38Z

Hi, I've worked my way from gulp-inject to here (gulp-inject v5.0.5 uses group-array v1.0.0 which in turn uses union-value v2.0.1 which uses set-value v3.0.0 ).
All these packages contain the above CVE in the set-value-package and there can be no fix in this chain unless set-value is updated here.
It would be wonderful if the PR could be merged and we could remove this CVE from all the packages.

carlRondoni · 2023-10-12T13:40:24Z

package.json

@@ -17,11 +17,12 @@
    "node": ">=6"


I would suggest to update the minimum node 6 engine to 12 for mocha minimum supported version on version 9.

carlRondoni · 2023-10-12T16:34:24Z

I hope soon we can merge this MR 🙏🏼

fix: lodash CVE-2021-41720, ansi-regex CVE-2021-3807, set-value CVE-2…

66f83bb

…021-23440

carlRondoni reviewed Oct 12, 2023

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: lodash CVE-2021-41720, ansi-regex CVE-2021-3807, set-value CVE-2… #13

fix: lodash CVE-2021-41720, ansi-regex CVE-2021-3807, set-value CVE-2… #13

nmccready commented Oct 7, 2021

JBartscher commented Jul 26, 2022 •

edited

Loading

carlRondoni Oct 12, 2023

carlRondoni commented Oct 12, 2023

fix: lodash CVE-2021-41720, ansi-regex CVE-2021-3807, set-value CVE-2… #13

Are you sure you want to change the base?

fix: lodash CVE-2021-41720, ansi-regex CVE-2021-3807, set-value CVE-2… #13

Conversation

nmccready commented Oct 7, 2021

JBartscher commented Jul 26, 2022 • edited Loading

carlRondoni Oct 12, 2023

Choose a reason for hiding this comment

carlRondoni commented Oct 12, 2023

JBartscher commented Jul 26, 2022 •

edited

Loading