Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: #1845 bump js-yaml #1846

Merged
merged 3 commits into from
Sep 9, 2019
Merged

fix: #1845 bump js-yaml #1846

merged 3 commits into from
Sep 9, 2019

Conversation

pmespresso
Copy link
Contributor

Summary

What kind of change does this PR introduce? (check at least one)

  • Bugfix
  • Feature
  • Code style update
  • Refactor
  • Docs
  • Build-related changes
  • Other, please describe:

If changing the UI of default theme, please provide the before/after screenshot:

Does this PR introduce a breaking change? (check one)

  • Yes
  • No

If yes, please describe the impact and migration path for existing applications:

The PR fulfills these requirements:

  • When resolving a specific issue, it's referenced in the PR's title (e.g. fix #xxx[,#xxx], where "xxx" is the issue number)

You have tested in the following browsers: (Providing a detailed version will be better.)
It's pretty trivial and the tests pass.

  • Chrome
  • Firefox
  • Safari
  • Edge
  • IE

If adding a new feature, the PR's description includes:

  • A convincing reason for adding this feature
  • Related documents have been updated
  • Related tests have been updated

To avoid wasting your time, it's best to open a feature request issue first and wait for approval before working on it.

Other information:

@flozero
Copy link
Collaborator

flozero commented Sep 9, 2019

Hello ! Thx for PR is there any reason to update to this version ?

@flozero flozero added the need feedback Awaiting author response label Sep 9, 2019
@pmespresso
Copy link
Contributor Author

@f3ltron thanks for the quick response! I raised the issue here. #1845

@pmespresso
Copy link
Contributor Author

basically:

nodeca/js-yaml#475
Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

nodeca/js-yaml#480
Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.

@kefranabg
Copy link
Collaborator

Hi @yjkimjunior,

I don't see any changes on yarn.lock?

@kefranabg
Copy link
Collaborator

@yjkimjunior How did you update the yarn.lock? It seems that there is a lot of changes for just one dependency update 🤔

@pmespresso
Copy link
Contributor Author

pmespresso commented Sep 9, 2019

@kefranabg
I just bumped the version number in package.json, then rm yarn.lock && yarn

@kefranabg
Copy link
Collaborator

Ok, that's what I thought 😉 Doing this is kind of risky. However I made a test by running yarn upgrade js-yaml@latest and it just changed package.json (not yarn.lock) so you can revert your last commit. Sorry for that @yjkimjunior

@flozero flozero merged commit 696717b into vuejs:master Sep 9, 2019
@vue-bot
Copy link

vue-bot commented Sep 9, 2019

Hey @yjkimjunior, thank you for your time and effort spent on this PR, contributions like yours help make Vue better for everyone. Cheers! 💚

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
need feedback Awaiting author response
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants