Skip to content

Update yargs-parser dependency #137

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
sindresorhus merged 1 commit into from
Mar 19, 2020
Merged

Update yargs-parser dependency #137

sindresorhus merged 1 commit into from
Mar 19, 2020

Conversation

@jakejarvis
Copy link
Contributor

@jakejarvis jakejarvis commented Mar 18, 2020 •
edited
Loading

yargs-parser v18.1.1 fixes a prototype pollution vulnerability:

? ✗ Medium severity vuln found in [email protected], introduced via [email protected]
    Description: Prototype Pollution
    Info: https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
    From: [email protected] > [email protected]

https://app.snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
yargs/yargs-parser#258

Thanks! 😊

@sindresorhus sindresorhus changed the title deps: Bump yargs-parser to v18.1.1 (fixes vulnerability) Update yargs-parser dependency Mar 19, 2020
@sindresorhus sindresorhus merged commit 4527b45 into sindresorhus:master Mar 19, 2020
@sindresorhus
Copy link
Owner

sindresorhus commented Mar 19, 2020

I'm merging this to silence the warning for people, but I strongly disagree that this is a vulnerability, and also, Snyk is not a trusted source: https://twitter.com/sindresorhus/status/1123986529498664961

@snyk-bot snyk-bot mentioned this pull request Mar 22, 2020
Merged
@xtqqczze xtqqczze mentioned this pull request May 2, 2020
Merged
This was referenced May 5, 2020
Merged
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jakejarvis @sindresorhus