Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

[Snyk] Security upgrade yargs from 3.32.0 to 16.0.0 #2

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 758/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.3
Prototype Pollution
SNYK-JS-Y18N-1021887
Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: yargs The new version differs by 250 commits.
  • 1ffb927 chore: v16.0.0 release
  • 5e5e5d0 chore: release 16.0.0 (#1698)
  • b215fba feat: adds strictOptions() (#1738)
  • c7debe8 feat(helpers): rebase, Parser, applyExtends now blessed helpers (#1733)
  • c71783a feat: i18n for ESM and Deno (#1735)
  • d360577 build: use release-please action (#1736)
  • 4151fee feat: tweaks to API surface based on user feedback (#1726)
  • 60234a4 deps(typescript): upgrade to typescript@4.x (#1728)
  • bad6f76 docs: use URL to images, for benefit of Deno (#1727)
  • b1f647b chore: add back yargs logo
  • ac6d5d1 feat: adds support for ESM and Deno (#1708)
  • 0f81024 fix(yargs): add missing command(module) signature (#1707)
  • a552990 feat(usage)!: single char aliases first in help (#1574)
  • f5997e8 refactor(ts): move to TypeScript release of yargs-parser (#1696)
  • c06f886 refactor(ts)!: ship yargs.d.ts (#1671)
  • 56a589f chore(deps): update dependency @types/mocha to v8 (#1689)
  • df283d3 chore(deps): update dependency mocha to v8 (#1674)
  • 863937f feat!: drop support for EOL Node 8 (#1686)
  • 028b50d chore: release 15.4.0 (#1635)
  • 225ab82 feat: support array of examples (#1682)
  • e68334b refactor(ts): move and tsify most of root yargs.js to lib/yargs (#1670)
  • cb7fbb8 chore: remove old entries from `files` field in `package.json (#1677)
  • 34949f8 Revert "chore(deps): update dependency eslint to v7 (#1656)" (#1673)
  • 18c2efd docs(api): clarify process.argv handling and the order of API methods (#1644)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-Y18N-1021887
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant