Skip to content

yargs-parser vulnerability #19

New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Closed
SirPryderi opened this issue Jul 16, 2020 · 1 comment
Closed

yargs-parser vulnerability #19

SirPryderi opened this issue Jul 16, 2020 · 1 comment

Comments

@SirPryderi
Copy link

I am experiencing an issue due to an old version of a very old version of Webpack, which depends on a yargs-parser.

Any changes to get it bumped up to newer version of Webpack?

yarn audit v1.22.1
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-recaptcha-google                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ react-recaptcha-google > webpack > yargs > yargs-parser      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1500                        │
└───────────────┴──────────────────────────────────────────────────────────────┘
@SirPryderi
Copy link
Author

Closing, as it is a duplicate of #17.

Managed to solve using this on yarn:

"resolutions": {
  "react-recaptcha-google/webpack": "^4.0.0"
}

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant