Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Force update minimist dependency #1380

Merged
merged 1 commit into from
Mar 23, 2022
Merged

Force update minimist dependency #1380

merged 1 commit into from
Mar 23, 2022

Conversation

kamil-stripe
Copy link
Contributor

@kamil-stripe kamil-stripe commented Mar 23, 2022

Bumps minimist from 1.2.5 to 1.2.6.

Affected versions of this package are vulnerable to Prototype Pollution due to a missing handler to Function.prototype. Note: this is a bypass to CVE-2020-7598

Copy link
Contributor

@dcr-stripe dcr-stripe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - let's add a proper PR description though just explaining what we changed and why we had to force pin it.

@kamil-stripe kamil-stripe merged commit 45a42fb into master Mar 23, 2022
@kamil-stripe kamil-stripe deleted the kamil/minimist branch March 23, 2022 21:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants