Skip to content

Conversation

@ghost
Copy link

@ghost ghost commented May 9, 2018

Upgrading rc to 1.2.7. This should fix #378

@brettz9
Copy link

brettz9 commented May 28, 2018

Any ETA on this getting reviewed, merged, and released?

@merlinstardust
Copy link

There is now 1.2.8 for rc, so might as well update to that while this merge is waiting

@zhuangya
Copy link

There is now 1.2.8 for rc, so might as well update to that while this merge is waiting

just change rc's version to 10.0.0

@gustawdaniel
Copy link

I see that in v0.10.0 of this pacage version of rc is ^1.1.7. Taking into account this update of rc

dominictarr/rc@73f285b

to version 1.2.8 that updated version of deep-extend to 0.6.0 i propose to change version of

rc in this package to 1.2.8.

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ deep-extend                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.5.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ bcrypt                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ bcrypt > node-pre-gyp > rc > deep-extend                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/612                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

@springmeyer springmeyer added this to the 0.10.2 milestone Jun 24, 2018
hyj1991 pushed a commit to X-Profiler/node-pre-gyp that referenced this pull request Jun 16, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

security vulnerability caused by [email protected]

5 participants