fix: address prototype pollution issue #108
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ljharb
approved these changes
Oct 25, 2020
|
@bcoe - that is great to hear - we'd love to work with you to get fixes into the repository in the future. Would you be available to discuss this further together? |
|
@JamieSlome happy to discuss more, email is a good place to start as I'm pretty full of meetings over the next few weeks. |
|
@bcoe - I will shoot over an e-mail to you today! |
This was referenced Nov 3, 2020
|
@bcoe will this be backported in the older major version ?
|
billyvg
pushed a commit
to getsentry/sentry
that referenced
this pull request
Mar 30, 2021
Bumps [y18n](https://github.com/yargs/y18n) from 4.0.0 to 4.0.1. - [Release notes](https://github.com/yargs/y18n/releases) - [Changelog](https://github.com/yargs/y18n/blob/master/CHANGELOG.md) - [Commits](https://github.com/yargs/y18n/commits) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> There's no changelog entry for this version, but based on the publish date of `4.0.1`, I think the release addresses this issue: yargs/y18n#108
Closed
This was referenced Apr 1, 2021
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
@po6ix @joaogmauricio I appreciate the vulnerability report, I believe this addresses the problem (_let me know if you can confirm). Also let me know if you can think of any additional regression tests.
@JamieSlome, @alromh87, I like the idea of huntr, I'd rather have a company submit a patch than simply notify me of a CVE. #107 was just not inline with how I've been addressing this issue elsewhere in the yargs codebase.
CC: @ljharb
Fixes: #96