Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security vulnerability in dependency #204

Open
pfaffle opened this issue Feb 15, 2020 · 0 comments
Open

Security vulnerability in dependency #204

pfaffle opened this issue Feb 15, 2020 · 0 comments

Comments

@pfaffle
Copy link

pfaffle commented Feb 15, 2020

npm/yarn audit has started failing on this package because a vulnerability in the version of qs it depends on. Can you update it to a patched version?

C:\Users\pfaffle\git\tripwire\ui [master ≡]> yarn audit
yarn audit v1.22.0
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ Prototype Pollution Protection Bypass                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ qs                                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=6.0.4 <6.1.0 || >=6.1.2 <6.2.0 || >=6.2.3 <6.3.0 ||        │
│               │ >=6.3.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ redux-api                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ redux-api > qs                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1469                        │
└───────────────┴──────────────────────────────────────────────────────────────┘
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant