Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

npm vulnerability: minimist #8722

Closed
bsclifton opened this issue Mar 17, 2020 · 6 comments · Fixed by #8724, brave/sync#374, brave/sync#380 or #8788
Closed

npm vulnerability: minimist #8722

bsclifton opened this issue Mar 17, 2020 · 6 comments · Fixed by #8724, brave/sync#374, brave/sync#380 or #8788
Assignees
@bsclifton
Labels
dev-concern QA/No release-notes/exclude
Milestone
1.8.x - Release

Comments

@bsclifton
Copy link
Member

Description

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ jest [dev]                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ jest > @jest/core > jest-runner > jest-jasmine2 >            │
│               │ jest-runtime > @jest/transform > jest-haste-map > sane >     │
│               │ @cnakazawa/watch > minimist                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

Steps to Reproduce

  1. Have full setup of Brave
  2. run npm run audit_deps from root
  3. have a bad time
@bsclifton bsclifton added this to the 1.8.x - Nightly milestone Mar 17, 2020
This was referenced Mar 17, 2020
Merged
Merged
@bsclifton bsclifton mentioned this issue Mar 17, 2020
Merged
29 tasks
@bsclifton bsclifton reopened this Mar 17, 2020
This was referenced Mar 18, 2020
Merged
Merged
Merged
Merged
Merged
@bsclifton bsclifton mentioned this issue Mar 18, 2020
Closed
32 tasks
bsclifton added a commit to brave/sync that referenced this issue Mar 18, 2020
@bsclifton
Introduce npm-force-resolutions dependency to help resolve npm audi…
13e6b9c 
…t vulnerabilities

Helps to fix brave/brave-browser#8722
bsclifton added a commit to brave/sync that referenced this issue Mar 18, 2020
@bsclifton
Introduce npm-force-resolutions dependency to help resolve npm audi…
372fe7d 
…t vulnerabilities

Helps to fix brave/brave-browser#8722
This was referenced Mar 18, 2020
Merged
Merged
bsclifton added a commit that referenced this issue Mar 18, 2020
@bsclifton
Introduce npm-force-resolutions dependency to help resolve npm audi…
54cb764 
…t vulnerabilities

Helps to fix #8722
@bsclifton bsclifton mentioned this issue Mar 18, 2020
Closed
29 tasks
@bsclifton bsclifton self-assigned this Mar 18, 2020
ryanml added a commit to brave/brave-core that referenced this issue Mar 18, 2020
@ryanml
Adds npm-force-resolutions dependency
6a0ddbf 
Partially resolves brave/brave-browser#8722
bsclifton added a commit to brave/brave-core that referenced this issue Mar 18, 2020
@bsclifton
Introduce npm-force-resolutions dependency to help resolve npm audi…
e0424d6 
…t vulnerabilities

Helps to fix brave/brave-browser#8722
bsclifton added a commit that referenced this issue Mar 18, 2020
@bsclifton
Introduce npm-force-resolutions dependency to help resolve npm audi…
492815e 
…t vulnerabilities

Helps to fix #8722
bsclifton added a commit to brave/sync that referenced this issue Mar 18, 2020
@bsclifton
Introduce npm-force-resolutions dependency to help resolve npm audi…
fac6066 
…t vulnerabilities

Helps to fix brave/brave-browser#8722
bsclifton added a commit to brave/sync that referenced this issue Mar 18, 2020
@bsclifton
Introduce npm-force-resolutions dependency to help resolve npm audi…
fb336a7 
…t vulnerabilities

Helps to fix brave/brave-browser#8722
bsclifton added a commit that referenced this issue Mar 24, 2020
@bsclifton
Rebuild package-lock.json to fix npm audit errors
938e733 
Fixes #8722
@bsclifton
Copy link
Member Author

Should be completely resolved with brave/brave-core#5013 and #8788

This was referenced Mar 26, 2020
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
bsclifton added a commit that referenced this issue Mar 31, 2020
@bsclifton
Update npm deps for 1.7
de15d61 
Fixes #8722 for 1.7 (`brave-browser`)
bsclifton added a commit to brave/brave-core that referenced this issue Mar 31, 2020
@bsclifton
Update npm deps for 1.7
ea2de73 
Fixes brave/brave-browser#8722 for 1.7 (`brave-core`)
This was referenced Mar 31, 2020
Closed
Closed
This was referenced Mar 31, 2020
Merged
Merged
Merged
Merged
Merged
Merged
@bbondy bbondy added this to the 1.7.x - Release milestone Jun 1, 2020
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees

@bsclifton bsclifton

Labels
dev-concern QA/No release-notes/exclude
Projects
None yet
Milestone
1.8.x - Release
5 participants
@bbondy @kjozwiak @cezaraugusto @bsclifton @ryanml