This repository has been archived by the owner on Oct 28, 2020. It is now read-only.
Update acorn dependency for security updates #114
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
es-check pins the acorn dependency to 6.1.1, which has a security issue: https://www.npmjs.com/advisories/1488 This updates and loosens the version constraint to a patched version.
|
Fixes #115. |
apepper
approved these changes
Mar 17, 2020
bigsergey
approved these changes
May 13, 2020
|
Can we merge PR? |
akellbl4
approved these changes
May 19, 2020
iadcode
approved these changes
Jun 17, 2020
|
Any update on this? |
cssagogo
approved these changes
Jun 27, 2020
AnaA95
approved these changes
Jul 16, 2020
|
Hey, any updates? |
|
Hey, did this got lost? What's blocking the merge? |
yowainwright
approved these changes
Sep 3, 2020
jakiestfu
approved these changes
Sep 3, 2020
|
@jakiestfu Thank you for merging this PR! Any ETA when a new release of |
|
Any update on a release? We'd like to upgrade to take care of vulnerabilities reported for Acorn. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
es-check pins the acorn dependency to 6.1.1, which has a security issue:
https://www.npmjs.com/advisories/1488
You'd have to run untrusted user input through es-check for this to potentially be an issue, so I'm not sure how likely that is. However, it would still be nice to get this patched and a new version of
es-checkreleased so that this doesn't cause issues innpm audit/yarn audittypes of vulnerability reports wheneveres-checkis used.Proposed Changes
acorndependency requirement from6.1.1to^6.4.1. Versions 6.4.1 or 7.1.1 and later of acorn are patched. I thought it might be beneficial to loosen the version constraint at the same time, so potentially future patches on the 6.x series could automatically be upgraded, rather than requiring explicit upgrades on es-check's part. But let me know if you'd prefer keeping it pinned to an exact version, and happy to update this pull request.Thanks!