From d35f8e76128eff76d06ec4ddc60da5d6daa25e71 Mon Sep 17 00:00:00 2001 From: Phillip Peralez Date: Mon, 26 Nov 2018 11:26:32 -0800 Subject: [PATCH 1/3] lock event-stream to non-compromised version --- package.json | 1 + yarn.lock | 41 +++++++++++++++++++++++++++++++++++------ 2 files changed, 36 insertions(+), 6 deletions(-) diff --git a/package.json b/package.json index 433edd01d..28dc948fc 100644 --- a/package.json +++ b/package.json @@ -59,6 +59,7 @@ "dotenv": "^5.0.1", "express": "^4.16.2", "express-winston": "^2.4.0", + "event-stream": "^4.0.1", "hipchatter": "^1.0.0", "jira-client": "^6.4.1", "mailchimp": "^1.2.0", diff --git a/yarn.lock b/yarn.lock index a0d90c286..10bdf27dd 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1314,9 +1314,9 @@ duplexer3@^0.1.4: version "0.1.4" resolved "https://registry.yarnpkg.com/duplexer3/-/duplexer3-0.1.4.tgz#ee01dd1cac0ed3cbc7fdbea37dc0a8f1ce002ce2" -duplexer@~0.1.1: +duplexer@^0.1.1, duplexer@~0.1.1: version "0.1.1" - resolved "https://registry.yarnpkg.com/duplexer/-/duplexer-0.1.1.tgz#ace6ff808c1ce66b57d1ebf97977acb02334cfc1" + resolved "http://registry.npmjs.org/duplexer/-/duplexer-0.1.1.tgz#ace6ff808c1ce66b57d1ebf97977acb02334cfc1" duplexify@^3.5.0, duplexify@^3.6.0: version "3.6.0" @@ -1401,6 +1401,18 @@ etag@~1.8.1: version "1.8.1" resolved "https://registry.yarnpkg.com/etag/-/etag-1.8.1.tgz#41ae2eeb65efa62268aebfea83ac7d79299b0887" +event-stream@^4.0.1: + version "4.0.1" + resolved "https://registry.yarnpkg.com/event-stream/-/event-stream-4.0.1.tgz#4092808ec995d0dd75ea4580c1df6a74db2cde65" + dependencies: + duplexer "^0.1.1" + from "^0.1.7" + map-stream "0.0.7" + pause-stream "^0.0.11" + split "^1.0.1" + stream-combiner "^0.2.2" + through "^2.3.8" + event-stream@~3.3.0: version "3.3.4" resolved "http://registry.npmjs.org/event-stream/-/event-stream-3.3.4.tgz#4ab4c9a0f5a54db9338b4c34d86bfce8f4b35571" @@ -1637,7 +1649,7 @@ from2@^2.1.1: inherits "^2.0.1" readable-stream "^2.0.0" -from@~0: +from@^0.1.7, from@~0: version "0.1.7" resolved "https://registry.yarnpkg.com/from/-/from-0.1.7.tgz#83c60afc58b9c56997007ed1a768b3ab303a44fe" @@ -2630,6 +2642,10 @@ map-cache@^0.2.2: version "0.2.2" resolved "https://registry.yarnpkg.com/map-cache/-/map-cache-0.2.2.tgz#c32abd0bd6525d9b051645bb4f26ac5dc98a0dbf" +map-stream@0.0.7: + version "0.0.7" + resolved "https://registry.yarnpkg.com/map-stream/-/map-stream-0.0.7.tgz#8a1f07896d82b10926bd3744a2420009f88974a8" + map-stream@~0.1.0: version "0.1.0" resolved "https://registry.yarnpkg.com/map-stream/-/map-stream-0.1.0.tgz#e56aa94c4c8055a16404a0674b78f215f7c8e194" @@ -3217,9 +3233,9 @@ pathval@^1.0.0: version "1.1.0" resolved "https://registry.yarnpkg.com/pathval/-/pathval-1.1.0.tgz#b942e6d4bde653005ef6b71361def8727d0645e0" -pause-stream@0.0.11: +pause-stream@0.0.11, pause-stream@^0.0.11: version "0.0.11" - resolved "https://registry.yarnpkg.com/pause-stream/-/pause-stream-0.0.11.tgz#fe5a34b0cbce12b5aa6a2b403ee2e73b602f1445" + resolved "http://registry.npmjs.org/pause-stream/-/pause-stream-0.0.11.tgz#fe5a34b0cbce12b5aa6a2b403ee2e73b602f1445" dependencies: through "~2.3" @@ -3930,6 +3946,12 @@ split@0.3: dependencies: through "2" +split@^1.0.1: + version "1.0.1" + resolved "https://registry.yarnpkg.com/split/-/split-1.0.1.tgz#605bd9be303aa59fb35f9229fbea0ddec9ea07d9" + dependencies: + through "2" + sprintf-js@~1.0.2: version "1.0.3" resolved "https://registry.yarnpkg.com/sprintf-js/-/sprintf-js-1.0.3.tgz#04e6926f662895354f3dd015203633b857297e2c" @@ -3991,6 +4013,13 @@ stealthy-require@^1.1.0: version "1.1.1" resolved "https://registry.yarnpkg.com/stealthy-require/-/stealthy-require-1.1.1.tgz#35b09875b4ff49f26a777e509b3090a3226bf24b" +stream-combiner@^0.2.2: + version "0.2.2" + resolved "http://registry.npmjs.org/stream-combiner/-/stream-combiner-0.2.2.tgz#aec8cbac177b56b6f4fa479ced8c1912cee52858" + dependencies: + duplexer "~0.1.1" + through "~2.3.4" + stream-combiner@~0.0.4: version "0.0.4" resolved "https://registry.yarnpkg.com/stream-combiner/-/stream-combiner-0.0.4.tgz#4d5e433c185261dde623ca3f44c586bcf5c4ad14" @@ -4140,7 +4169,7 @@ through2@^2.0.0, through2@^2.0.3: readable-stream "^2.1.5" xtend "~4.0.1" -through@2, through@~2.3, through@~2.3.1: +through@2, through@^2.3.8, through@~2.3, through@~2.3.1, through@~2.3.4: version "2.3.8" resolved "https://registry.yarnpkg.com/through/-/through-2.3.8.tgz#0dd4c9ffaabc357960b1b724115d7e0e86a2e1f5" From a206aa96662157dfd1a980889dec364012dd689a Mon Sep 17 00:00:00 2001 From: Phillip Peralez Date: Mon, 26 Nov 2018 11:37:36 -0800 Subject: [PATCH 2/3] Per comment on another repo addressing security issue, 3.3.4 is before the flatmap change --- package.json | 2 +- yarn.lock | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package.json b/package.json index 28dc948fc..a1e3c6be6 100644 --- a/package.json +++ b/package.json @@ -59,7 +59,7 @@ "dotenv": "^5.0.1", "express": "^4.16.2", "express-winston": "^2.4.0", - "event-stream": "^4.0.1", + "event-stream": "^3.3.4", "hipchatter": "^1.0.0", "jira-client": "^6.4.1", "mailchimp": "^1.2.0", diff --git a/yarn.lock b/yarn.lock index 10bdf27dd..86d82e5ff 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1401,9 +1401,9 @@ etag@~1.8.1: version "1.8.1" resolved "https://registry.yarnpkg.com/etag/-/etag-1.8.1.tgz#41ae2eeb65efa62268aebfea83ac7d79299b0887" -event-stream@^4.0.1: - version "4.0.1" - resolved "https://registry.yarnpkg.com/event-stream/-/event-stream-4.0.1.tgz#4092808ec995d0dd75ea4580c1df6a74db2cde65" +event-stream@^3.3.4: + version "3.3.5" + resolved "https://registry.yarnpkg.com/event-stream/-/event-stream-3.3.5.tgz#e5dd8989543630d94c6cf4d657120341fa31636b" dependencies: duplexer "^0.1.1" from "^0.1.7" From c56ee8bc0baeb97135174d359d90d191c66cd379 Mon Sep 17 00:00:00 2001 From: Phillip Peralez Date: Mon, 26 Nov 2018 11:51:15 -0800 Subject: [PATCH 3/3] Use resolutions to force dependencies --- package.json | 4 +++- yarn.lock | 47 +++++++++-------------------------------------- 2 files changed, 12 insertions(+), 39 deletions(-) diff --git a/package.json b/package.json index a1e3c6be6..07da29a93 100644 --- a/package.json +++ b/package.json @@ -59,7 +59,6 @@ "dotenv": "^5.0.1", "express": "^4.16.2", "express-winston": "^2.4.0", - "event-stream": "^3.3.4", "hipchatter": "^1.0.0", "jira-client": "^6.4.1", "mailchimp": "^1.2.0", @@ -84,6 +83,9 @@ "engines": { "node": "10.8.0" }, + "resolutions": { + "**/event-stream": "3.3.4" + }, "devDependencies": { "@types/chai": "^4.0.4", "@types/chai-as-promised": "^7.1.0", diff --git a/yarn.lock b/yarn.lock index 86d82e5ff..a30b9b703 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1314,7 +1314,7 @@ duplexer3@^0.1.4: version "0.1.4" resolved "https://registry.yarnpkg.com/duplexer3/-/duplexer3-0.1.4.tgz#ee01dd1cac0ed3cbc7fdbea37dc0a8f1ce002ce2" -duplexer@^0.1.1, duplexer@~0.1.1: +duplexer@~0.1.1: version "0.1.1" resolved "http://registry.npmjs.org/duplexer/-/duplexer-0.1.1.tgz#ace6ff808c1ce66b57d1ebf97977acb02334cfc1" @@ -1401,19 +1401,7 @@ etag@~1.8.1: version "1.8.1" resolved "https://registry.yarnpkg.com/etag/-/etag-1.8.1.tgz#41ae2eeb65efa62268aebfea83ac7d79299b0887" -event-stream@^3.3.4: - version "3.3.5" - resolved "https://registry.yarnpkg.com/event-stream/-/event-stream-3.3.5.tgz#e5dd8989543630d94c6cf4d657120341fa31636b" - dependencies: - duplexer "^0.1.1" - from "^0.1.7" - map-stream "0.0.7" - pause-stream "^0.0.11" - split "^1.0.1" - stream-combiner "^0.2.2" - through "^2.3.8" - -event-stream@~3.3.0: +event-stream@3.3.4, event-stream@~3.3.0: version "3.3.4" resolved "http://registry.npmjs.org/event-stream/-/event-stream-3.3.4.tgz#4ab4c9a0f5a54db9338b4c34d86bfce8f4b35571" dependencies: @@ -1649,7 +1637,7 @@ from2@^2.1.1: inherits "^2.0.1" readable-stream "^2.0.0" -from@^0.1.7, from@~0: +from@~0: version "0.1.7" resolved "https://registry.yarnpkg.com/from/-/from-0.1.7.tgz#83c60afc58b9c56997007ed1a768b3ab303a44fe" @@ -2642,13 +2630,9 @@ map-cache@^0.2.2: version "0.2.2" resolved "https://registry.yarnpkg.com/map-cache/-/map-cache-0.2.2.tgz#c32abd0bd6525d9b051645bb4f26ac5dc98a0dbf" -map-stream@0.0.7: - version "0.0.7" - resolved "https://registry.yarnpkg.com/map-stream/-/map-stream-0.0.7.tgz#8a1f07896d82b10926bd3744a2420009f88974a8" - map-stream@~0.1.0: version "0.1.0" - resolved "https://registry.yarnpkg.com/map-stream/-/map-stream-0.1.0.tgz#e56aa94c4c8055a16404a0674b78f215f7c8e194" + resolved "http://registry.npmjs.org/map-stream/-/map-stream-0.1.0.tgz#e56aa94c4c8055a16404a0674b78f215f7c8e194" map-visit@^1.0.0: version "1.0.0" @@ -3233,7 +3217,7 @@ pathval@^1.0.0: version "1.1.0" resolved "https://registry.yarnpkg.com/pathval/-/pathval-1.1.0.tgz#b942e6d4bde653005ef6b71361def8727d0645e0" -pause-stream@0.0.11, pause-stream@^0.0.11: +pause-stream@0.0.11: version "0.0.11" resolved "http://registry.npmjs.org/pause-stream/-/pause-stream-0.0.11.tgz#fe5a34b0cbce12b5aa6a2b403ee2e73b602f1445" dependencies: @@ -3942,13 +3926,7 @@ split-string@^3.0.1, split-string@^3.0.2: split@0.3: version "0.3.3" - resolved "https://registry.yarnpkg.com/split/-/split-0.3.3.tgz#cd0eea5e63a211dfff7eb0f091c4133e2d0dd28f" - dependencies: - through "2" - -split@^1.0.1: - version "1.0.1" - resolved "https://registry.yarnpkg.com/split/-/split-1.0.1.tgz#605bd9be303aa59fb35f9229fbea0ddec9ea07d9" + resolved "http://registry.npmjs.org/split/-/split-0.3.3.tgz#cd0eea5e63a211dfff7eb0f091c4133e2d0dd28f" dependencies: through "2" @@ -4013,16 +3991,9 @@ stealthy-require@^1.1.0: version "1.1.1" resolved "https://registry.yarnpkg.com/stealthy-require/-/stealthy-require-1.1.1.tgz#35b09875b4ff49f26a777e509b3090a3226bf24b" -stream-combiner@^0.2.2: - version "0.2.2" - resolved "http://registry.npmjs.org/stream-combiner/-/stream-combiner-0.2.2.tgz#aec8cbac177b56b6f4fa479ced8c1912cee52858" - dependencies: - duplexer "~0.1.1" - through "~2.3.4" - stream-combiner@~0.0.4: version "0.0.4" - resolved "https://registry.yarnpkg.com/stream-combiner/-/stream-combiner-0.0.4.tgz#4d5e433c185261dde623ca3f44c586bcf5c4ad14" + resolved "http://registry.npmjs.org/stream-combiner/-/stream-combiner-0.0.4.tgz#4d5e433c185261dde623ca3f44c586bcf5c4ad14" dependencies: duplexer "~0.1.1" @@ -4169,9 +4140,9 @@ through2@^2.0.0, through2@^2.0.3: readable-stream "^2.1.5" xtend "~4.0.1" -through@2, through@^2.3.8, through@~2.3, through@~2.3.1, through@~2.3.4: +through@2, through@~2.3, through@~2.3.1: version "2.3.8" - resolved "https://registry.yarnpkg.com/through/-/through-2.3.8.tgz#0dd4c9ffaabc357960b1b724115d7e0e86a2e1f5" + resolved "http://registry.npmjs.org/through/-/through-2.3.8.tgz#0dd4c9ffaabc357960b1b724115d7e0e86a2e1f5" timed-out@4.0.1, timed-out@^4.0.0, timed-out@^4.0.1: version "4.0.1"