Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update dependency lodash to v4.17.21 #130

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

mend-for-github-com[bot]
Copy link

@mend-for-github-com mend-for-github-com bot commented Jan 25, 2023

This PR contains the following updates:

Package Type Update Change
lodash (source) dependencies patch 4.17.19 -> 4.17.21

By merging this PR, the below issues will be automatically resolved and closed:

Severity CVSS Score CVE GitHub Issue
High 7.2 CVE-2021-23337 #38

Release Notes

lodash/lodash (lodash)

v4.17.21

Compare Source

v4.17.20

Compare Source


  • If you want to rebase/retry this PR, check this box

@mend-for-github-com mend-for-github-com bot added the security fix Security fix generated by WhiteSource label Jan 25, 2023
@mend-for-github-com
Copy link
Author

mend-for-github-com bot commented Jan 25, 2023

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: packages/mongoose/package-lock.json
lerna notice cli v3.22.1
lerna info versioning independent
lerna info Bootstrapping 6 packages
lerna info Installing external dependencies
lerna ERR! npm install --ignore-scripts --ignore-scripts --no-audit --package-lock-only exited 1 in '@davinci/mongoose'
lerna ERR! npm install --ignore-scripts --ignore-scripts --no-audit --package-lock-only stderr:
npm WARN old lockfile 
npm WARN old lockfile The package-lock.json file was created with an old version of npm,
npm WARN old lockfile so supplemental metadata must be fetched from the registry.
npm WARN old lockfile 
npm WARN old lockfile This is a one-time fix-up, please be patient...
npm WARN old lockfile 
npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: @davinci/[email protected]
npm ERR! Found: [email protected]
npm ERR! node_modules/mongoose
npm ERR!   dev mongoose@"5.7.5" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer mongoose@"^6.6.2" from @davinci/[email protected]
npm ERR! node_modules/@davinci/core
npm ERR!   peer @davinci/core@"^1.0.0" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! 
npm ERR! For a full report see:
npm ERR! /tmp/renovate/cache/others/npm/_logs/2023-10-14T06_23_16_478Z-eresolve-report.txt

npm ERR! A complete log of this run can be found in: /tmp/renovate/cache/others/npm/_logs/2023-10-14T06_23_16_478Z-debug-0.log

lerna ERR! npm install --ignore-scripts --ignore-scripts --no-audit --package-lock-only exited 1 in '@davinci/mongoose'

@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/lodash-4.x branch from d1050ee to ec3a3a1 Compare October 14, 2023 06:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security fix Security fix generated by WhiteSource
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants