protractor > optimist > minimist Prototype Pollution
Bug report
- Node Version:
v13.10.1 - Protractor Version:
5.4.3 - Angular Version:
9.1.0
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low │ Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ minimist │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.2.1 <1.0.0 || >=1.2.3 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ protractor [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ protractor > optimist > minimist │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/1179 │
└───────────────┴──────────────────────────────────────────────────────────────┘
optimist is deprecated--maybe update to yargs?
sdavids
All 5 comments
The change has been completed by @alan-agius4 although it still hasn't been merged in. Is there any estimate on when these changes will be merged and released?
colbyhill21
on 9 Apr 2020
Is there a way to merge this existing pull request?
inpercima
on 11 Apr 2020
@alan-agius4 @kyliau: Considering the value of this patch i would suggest to issue a new release.
What do you think?
This could be relevant for many projects. Among the updates if anywone would like to review it i would kindly ask if we could try to include: https://github.com/angular/protractor/pull/5421
\cc @cnishina @sjelin @sjelin
evilaliv3
on 20 Apr 2020
@evilaliv3, a release containing this fix has already been cut (5.4.4)
alan-agius4
on 20 Apr 2020
Ah, i'm sorry for the confusion, the fact that you edited many comments that you wrote time ago messed up many of the dates that github shows and i fooled me. thank you for the clarification @alan-agius4 and @kyliau
evilaliv3
on 22 Apr 2020
Related issues
koshkarov
·
3Comments
vishalshivnath
·
3Comments
luakri
·
3Comments
andyman3693
·
3Comments
adityagautam
·
3Comments
Most helpful comment
@alan-agius4 @kyliau: Considering the value of this patch i would suggest to issue a new release.
What do you think?
This could be relevant for many projects. Among the updates if anywone would like to review it i would kindly ask if we could try to include: https://github.com/angular/protractor/pull/5421
\cc @cnishina @sjelin @sjelin