Skip to content
This repository has been archived by the owner on Aug 25, 2021. It is now read-only.

Security issue with dependency - minimist #375

Closed
tvvignesh opened this issue Mar 19, 2020 · 4 comments
Closed

Security issue with dependency - minimist #375

tvvignesh opened this issue Mar 19, 2020 · 4 comments
Assignees
Labels
kind/improvement An improvement to existing feature and code. tech/typescript Issue for tech TypeScript.
Milestone

Comments

@tvvignesh
Copy link

tvvignesh commented Mar 19, 2020

Hi. When installing the latest version of migrate (tried both preview024 and the latest alpha release), I get security issues relating to prisma's dependency (or rather the studio-server) minimist (Screenshot below). You may want to consider updating the dependency. Thanks.

PS: This is affecting not just this package, but many other packages as well like kafka-node, eslint, etc. Some other issues similar to this here:
eslint/eslint#13050
handlebars-lang/handlebars.js#1661

Screenshot from 2020-03-19 23-32-09

@pantharshit00 pantharshit00 added kind/improvement An improvement to existing feature and code. process/candidate Candidate for next Milestone. labels Apr 21, 2020
@janpio janpio added this to the Beta 4 milestone Apr 21, 2020
@janpio janpio added tech/typescript Issue for tech TypeScript. and removed process/candidate Candidate for next Milestone. labels Apr 21, 2020
Jolg42 added a commit to prisma/prisma that referenced this issue Apr 22, 2020
@Jolg42
Copy link
Contributor

Jolg42 commented Apr 22, 2020

So the issue in the dependencies referenced in @prisma/sdk was coming from the package @apexearth/copy

Screen Shot 2020-04-22 at 12 57 50

It is now fixed 😄

There is one more place were this low vulnerability can be found but it's in a devDependency bahmutov/snap-shot-it#514 we'll wait for an update there but this should not be a security issue for you.

@madebysid will also update dependencies in Studio

@sdnts
Copy link
Contributor

sdnts commented Apr 28, 2020

I've bumped up all dependencies in Studio as well now.

@Jolg42
Copy link
Contributor

Jolg42 commented Apr 29, 2020

Ok so I will close this once the latest version of Studio is included then!

@Jolg42
Copy link
Contributor

Jolg42 commented Apr 29, 2020

The latest version of studio is now in alpha so I will close this 😃

It will be in the next beta.

@Jolg42 Jolg42 closed this as completed Apr 29, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
kind/improvement An improvement to existing feature and code. tech/typescript Issue for tech TypeScript.
Projects
None yet
Development

No branches or pull requests

5 participants