Cz-cli: Minor vulnerability in lodash

Created on 18 Jul 2020  路  7Comments  路  Source: commitizen/cz-cli

Currently referencing lodash 4.17.15, which has a prototype pollution. It has been patched in >=4.17.19.

picture fendy-g
👍12

Most helpful comment

Can we have a release with #754 please

picture mohanraj-r on 29 Jul 2020
👍11

All 7 comments

I just noticed this as well. Looks like it was picked up by dependabot in #754

beeryt picture beeryt on 21 Jul 2020
👍2

More info: https://www.npmjs.com/advisories/1523

jshemas picture jshemas on 22 Jul 2020

So, is this going to be fixed ? Just adding the ^ in the package.json should do the trick.

"lodash": "^4.17.15"
dlarr picture dlarr on 23 Jul 2020

Can we have a release with #754 please

mohanraj-r picture mohanraj-r on 29 Jul 2020
👍11

+1 ^

fchenTelus picture fchenTelus on 7 Aug 2020

763

dmwelch picture dmwelch on 20 Aug 2020

@fendy-g this fix was included in version 4.1.3 by #766 馃帀

The release is available on:

npm package (@latest dist-tag)
GitHub release

Could we close it?

jimmyandrade picture jimmyandrade on 22 Aug 2020
Was this page helpful?
0 / 5 - 0 ratings

Related issues

scamden picture scamden  路  4Comments
fahimmahmoodmir picture fahimmahmoodmir  路  4Comments
rigobauer picture rigobauer  路  4Comments
emcniece picture emcniece  路  3Comments
gaurav5430 picture gaurav5430  路  7Comments