Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

npm vulnerability: minimist #8722

Closed
bsclifton opened this issue Mar 17, 2020 · 6 comments · Fixed by #8724, brave/sync#374, brave/sync#380 or #8788
Closed

npm vulnerability: minimist #8722

bsclifton opened this issue Mar 17, 2020 · 6 comments · Fixed by #8724, brave/sync#374, brave/sync#380 or #8788
Assignees
@bsclifton
Labels
dev-concern QA/No release-notes/exclude
Milestone
1.8.x - Release

Comments

@bsclifton
Copy link
Member

Description

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ jest [dev]                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ jest > @jest/core > jest-runner > jest-jasmine2 >            │
│               │ jest-runtime > @jest/transform > jest-haste-map > sane >     │
│               │ @cnakazawa/watch > minimist                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

Steps to Reproduce

  1. Have full setup of Brave
  2. run npm run audit_deps from root
  3. have a bad time
@bsclifton bsclifton added this to the 1.8.x - Nightly milestone Mar 17, 2020
This was referenced Mar 17, 2020
Merged
Merged
@bsclifton bsclifton mentioned this issue Mar 17, 2020
Merged
29 tasks
@bsclifton bsclifton reopened this Mar 17, 2020
This was referenced Mar 18, 2020
Merged
Merged
Merged
Merged
Merged
@bsclifton bsclifton mentioned this issue Mar 18, 2020
Closed
32 tasks
bsclifton added a commit to brave/sync that referenced this issue Mar 18, 2020
@bsclifton
Introduce npm-force-resolutions dependency to help resolve npm audi…
13e6b9c 
…t vulnerabilities

Helps to fix brave/brave-browser#8722
bsclifton added a commit to brave/sync that referenced this issue Mar 18, 2020
@bsclifton
Introduce npm-force-resolutions dependency to help resolve npm audi…
372fe7d 
…t vulnerabilities

Helps to fix brave/brave-browser#8722
This was referenced Mar 18, 2020
Merged
Merged
bsclifton added a commit that referenced this issue Mar 18, 2020
@bsclifton
Introduce npm-force-resolutions dependency to help resolve npm audi…
54cb764 
…t vulnerabilities

Helps to fix #8722
@bsclifton bsclifton mentioned this issue Mar 18, 2020
Closed
29 tasks
@bsclifton bsclifton self-assigned this Mar 18, 2020
ryanml added a commit to brave/brave-core that referenced this issue Mar 18, 2020
@ryanml
Adds npm-force-resolutions dependency
6a0ddbf 
Partially resolves brave/brave-browser#8722
bsclifton added a commit to brave/brave-core that referenced this issue Mar 18, 2020
@bsclifton
Introduce npm-force-resolutions dependency to help resolve npm audi…
e0424d6 
…t vulnerabilities

Helps to fix brave/brave-browser#8722
bsclifton added a commit that referenced this issue Mar 18, 2020
@bsclifton
Introduce npm-force-resolutions dependency to help resolve npm audi…
492815e 
…t vulnerabilities

Helps to fix #8722
bsclifton added a commit to brave/sync that referenced this issue Mar 18, 2020
@bsclifton
Introduce npm-force-resolutions dependency to help resolve npm audi…
fac6066 
…t vulnerabilities

Helps to fix brave/brave-browser#8722
bsclifton added a commit to brave/sync that referenced this issue Mar 18, 2020
@bsclifton
Introduce npm-force-resolutions dependency to help resolve npm audi…
fb336a7 
…t vulnerabilities

Helps to fix brave/brave-browser#8722
bsclifton added a commit that referenced this issue Mar 24, 2020
@bsclifton
Rebuild package-lock.json to fix npm audit errors
938e733 
Fixes #8722
@bsclifton
Copy link
Member Author

Should be completely resolved with brave/brave-core#5013 and #8788

This was referenced Mar 26, 2020
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
bsclifton added a commit that referenced this issue Mar 31, 2020
@bsclifton
Update npm deps for 1.7
de15d61 
Fixes #8722 for 1.7 (`brave-browser`)
bsclifton added a commit to brave/brave-core that referenced this issue Mar 31, 2020
@bsclifton
Update npm deps for 1.7
ea2de73 
Fixes brave/brave-browser#8722 for 1.7 (`brave-core`)
This was referenced Mar 31, 2020
Closed
Closed
This was referenced Mar 31, 2020
Merged
Merged
Merged
Merged
Merged
Merged
@bbondy bbondy added this to the 1.7.x - Release milestone Jun 1, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@bsclifton bsclifton

Labels
dev-concern QA/No release-notes/exclude
Projects
None yet
Milestone
1.8.x - Release
5 participants
@bbondy @kjozwiak @cezaraugusto @bsclifton @ryanml