Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Bump imagemin-cli to 6.0.0 & other imagemin dependencies #531

Merged

Conversation

WilliamCollishaw
Copy link
Contributor

This fixes the following 3 low severity findings from running npm audit in the imagemin packages

# Run  npm install --save-dev imagemin-cli@6.0.0  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ imagemin-cli [dev]                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ imagemin-cli > meow > yargs-parser                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1500                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


# Run  npm update mkdirp --depth 4  to resolve 2 vulnerabilities
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ imagemin-cli [dev]                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ imagemin-cli > imagemin-svgo > svgo > mkdirp > minimist      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ imagemin-svgo [dev]                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ imagemin-svgo > svgo > mkdirp > minimist                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

The follow commands were used to make these changes:

npm install --save-dev imagemin-cli@6.0.0
npm update mkdirp --depth 4

@jmhobbs
Copy link
Owner

jmhobbs commented Dec 22, 2020

Thanks!

@jmhobbs jmhobbs merged commit 4f872c4 into jmhobbs:master Dec 22, 2020
@WilliamCollishaw WilliamCollishaw deleted the imagemin-low-severity-security-fixes branch December 22, 2020 17:26
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants