Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update minimist to a non-vulnerable version. #3053

Merged
merged 1 commit into from
Mar 31, 2022

Conversation

lgarron
Copy link
Contributor

@lgarron lgarron commented Mar 30, 2022

  • This addresses an npm audit vulnerability alert for projects using workbox, which in turn depends on minimist@1.2.5: GHSA-xvch-5gv4-984h

Prior to creating a pull request, please follow all the steps in the contributing guide.

R: @jeffposnick @tropicadri

- This addresses an `npm audit` vulnerability alert for projects using `workbox`, which in turn depends on `minimist@1.2.5`: GHSA-xvch-5gv4-984h
@lgarron
Copy link
Contributor Author

lgarron commented Mar 30, 2022

Note: npm audit still warns about quite a few vulns with workbox dev dependencies:

node_modules/gulp/node_modules/y18n
node_modules/y18n

66 vulnerabilities (13 moderate, 52 high, 1 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

@jeffposnick jeffposnick self-requested a review March 31, 2022 13:41
@jeffposnick jeffposnick merged commit dec00e6 into GoogleChrome:v6 Mar 31, 2022
@lgarron lgarron deleted the minimist-vuln-update branch March 31, 2022 18:57
@lgarron
Copy link
Contributor Author

lgarron commented Mar 31, 2022

Thanks!
I'd appreciate a release soon so I can update workbox in my dependencies without hacks. :-D

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants