From 8fd945593147556a9f759c05de27925cd715b03c Mon Sep 17 00:00:00 2001 From: Rupal Mahajan Date: Tue, 11 Jul 2023 09:19:29 -0700 Subject: [PATCH] Add semver resolution to patch CVE-2022-25883 Signed-off-by: Rupal Mahajan --- package.json | 3 ++- yarn.lock | 18 ++++-------------- 2 files changed, 6 insertions(+), 15 deletions(-) diff --git a/package.json b/package.json index 4bdd529f..22c4c61e 100644 --- a/package.json +++ b/package.json @@ -55,6 +55,7 @@ "json-schema": "^0.4.0", "**/@types/react": "16.3.14", "yaml": "^2.2.2", - "tough-cookie": "^4.1.3" + "tough-cookie": "^4.1.3", + "semver": "^7.5.2" } } \ No newline at end of file diff --git a/yarn.lock b/yarn.lock index 2fd4c961..28281b11 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2342,23 +2342,13 @@ semver-regex@^3.1.2: resolved "https://registry.yarnpkg.com/semver-regex/-/semver-regex-3.1.4.tgz#13053c0d4aa11d070a2f2872b6b1e3ae1e1971b4" integrity sha512-6IiqeZNgq01qGf0TId0t3NvKzSvUsjcpdEO3AQNeIjR6A2+ckTnQlDpl4qu1bjRv0RzN3FP9hzFmws3lKqRWkA== -semver@7.x: - version "7.3.7" - resolved "https://registry.yarnpkg.com/semver/-/semver-7.3.7.tgz#12c5b649afdbf9049707796e22a4028814ce523f" - integrity sha512-QlYTucUYOews+WeEujDoEGziz4K6c47V/Bd+LjSSYcA94p+DmINdf7ncaUinThfvZyu13lN9OY1XDxt8C0Tw0g== +semver@7.x, semver@^5.3.0, semver@^5.5.0, semver@^6.1.2, semver@^7.5.2: + version "7.5.4" + resolved "https://registry.yarnpkg.com/semver/-/semver-7.5.4.tgz#483986ec4ed38e1c6c48c34894a9182dbff68a6e" + integrity sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA== dependencies: lru-cache "^6.0.0" -semver@^5.3.0, semver@^5.5.0: - version "5.7.1" - resolved "https://registry.yarnpkg.com/semver/-/semver-5.7.1.tgz#a954f931aeba508d307bbf069eff0c01c96116f7" - integrity sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ== - -semver@^6.1.2: - version "6.3.0" - resolved "https://registry.yarnpkg.com/semver/-/semver-6.3.0.tgz#ee0a64c8af5e8ceea67687b133761e1becbd1d3d" - integrity sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw== - shebang-command@^1.2.0: version "1.2.0" resolved "https://registry.yarnpkg.com/shebang-command/-/shebang-command-1.2.0.tgz#44aac65b695b03398968c39f363fee5deafdf1ea"