Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

Update @11ty/eleventy js-yaml nyc to fix npm audit vulnerabilities #3878

Closed
wants to merge 4 commits into from
Closed

Update @11ty/eleventy js-yaml nyc to fix npm audit vulnerabilities #3878

wants to merge 4 commits into from

Conversation

narayananramu
Copy link

@narayananramu narayananramu commented Apr 17, 2019 •
edited by plroebuck
Loading

Description of the Change

Update the below dependencies to address npm security advisories

@11ty/eleventy -> 0.8.2
js-yaml -> @3.13.1
nyc -> 14.0.0

Alternate Designs

N/A

Why should this be in core?

N/A

Benefits

Improved security

Possible Drawbacks

None

Applicable issues

Fixes #3880

@jsf-clabot
Copy link

jsf-clabot commented Apr 17, 2019 •
edited
Loading

CLA assistant check
All committers have signed the CLA.

@coveralls
Copy link

coveralls commented Apr 17, 2019 •
edited
Loading

Coverage Status

Coverage increased (+0.03%) to 91.739% when pulling 1bfc553 on narayananramu:issue/3876 into 0d9d4a3 on mochajs:master.

markowsiak
markowsiak approved these changes Apr 17, 2019
View reviewed changes
Copy link
Contributor

@markowsiak markowsiak left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for contributing 👍

@markowsiak markowsiak mentioned this pull request Apr 17, 2019
Merged
plroebuck
plroebuck reviewed Apr 17, 2019
View reviewed changes
package.json Outdated
@@ -512,7 +512,7 @@
"glob": "7.1.3",
"growl": "1.10.5",
"he": "1.2.0",
"js-yaml": "3.13.0",
"js-yaml": "^3.13.1",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fix for this already merged

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it be possible to publish a new release since the vulnerability is high? Thanks

@plroebuck plroebuck added the area: security involving vulnerabilities label Apr 17, 2019
@plroebuck
Copy link
Contributor

plroebuck commented Apr 17, 2019 •
edited
Loading

@Munter care to weigh in on eleventy update?

@plroebuck
Copy link
Contributor

plroebuck commented Apr 17, 2019 •
edited
Loading

nyc-14.0.0 has breaking changes; someone with more experience with this package will need to review.

@dewwwald dewwwald mentioned this pull request Apr 18, 2019
Closed
4 tasks
@dewwwald
Copy link

dewwwald commented Apr 18, 2019 •
edited
Loading

Thank you for fixing.

People are getting rowdy on the thread that is referenced. Commenting here to bump up to the maintainers inbox, consider merging and opening a separate thread for the breaking changes in eleventy.

@Bamieh
Copy link
Contributor

Bamieh commented Apr 18, 2019

According to the nyc changelog we should not be affected by the breaking changes. We can upgrade safely (https://github.com/istanbuljs/nyc/blob/master/CHANGELOG.md#1400-2019-04-15)

@welljsjs
Copy link

welljsjs commented Apr 18, 2019 •
edited
Loading

This has been merged in #3877. This seems to be a duplicate. v6.1.4 (just released) comes with updated dependencies.

@Bamieh
Copy link
Contributor

Bamieh commented Apr 18, 2019

@welljsjs this PR updates nyc and @11ty/eleventy which are not updated on master branch.

@welljsjs
Copy link

@Bamieh True. Sorry about the disturbance, I got it wrong.

Bamieh
Bamieh approved these changes Apr 19, 2019
View reviewed changes
Copy link
Contributor

@Bamieh Bamieh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Need to resolve conflict in lock file 1st.

@plroebuck
Copy link
Contributor

@Munter, ping! Waiting on your approval before updating eleventy...

@juergba
Copy link
Contributor

juergba commented Jun 6, 2019

@narayananramu sorry, I apologize.
closed, see #3939.

@juergba juergba closed this Jun 6, 2019
# for free to join this conversation on GitHub. Already have an account? # to comment
Reviewers

@plroebuck plroebuck plroebuck left review comments

@loayg loayg loayg left review comments

@outsideris outsideris outsideris approved these changes

@markowsiak markowsiak markowsiak approved these changes

@Bamieh Bamieh Bamieh approved these changes

Assignees
No one assigned
Labels
area: security involving vulnerabilities
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Vulnerability Advisory flaggs 1 high vulnerability in js-yaml for mocha@6.1.3