Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

CVE-2020-13822 #57

Closed
kwontae opened this issue Jul 27, 2020 · 2 comments · Fixed by #58
Closed

CVE-2020-13822 #57

kwontae opened this issue Jul 27, 2020 · 2 comments · Fixed by #58

Comments

@kwontae
Copy link

kwontae commented Jul 27, 2020

Elliptic had been caught by the component security scan for our team and it seems like they have a new release version 6.5.3
Could you guys make an update to your dependency graph?
@calvinmetcalf calvinmetcalf mentioned this issue Jul 28, 2020
Merged
@kwontae
Copy link
Author

kwontae commented Jul 28, 2020 •
edited
Loading

@calvinmetcalf A bump will require crypto-browserify to be bumped too correct? as browserify-sign is a dependency of crypto-browserify

@calvinmetcalf
Copy link
Contributor

i mean stictly speaking the fix is already in here because the version range we specify includes the fixed version, like you're only going to see this version if your dependencies are not up to date

@goatandsheep goatandsheep mentioned this issue Jul 30, 2020
Merged
Flux159 added a commit to Flux159/next-postgraphile that referenced this issue Aug 1, 2020
@Flux159
Updating elliptic to resolve to 6.5.3 in yarn.lock for browserify/bro…
9993efd 
…wserify-sign#57
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

bump elliptic browserify/browserify-sign
2 participants
@calvinmetcalf @kwontae