dep: [email protected] #116
Conversation
|
Our security scans encounter the same issue. Please, merge and release a new version. |
|
Looking at the advisory you linked, it looks like the issue only affects the |
There was a problem hiding this comment.
Please make the following adjustments so I can merge:
(1) Remove the ~
(2) Fix the commit message to mirror the other dependency update commits
(3) Update the History file to show the dependency update and explain in sub points what changes are introduced from the change between debug 2.6.1 and 2.6.8
Thanks!
|
@dougwilson Ready for another pass. |
HISTORY.md
Outdated
| - Use same color for same namespace | ||
| - deps: ms@0.7.2 | ||
| - deps: ms@2.0.0 to fix regular expression denial of service vulnerability |
There was a problem hiding this comment.
We don't list changes in sub dependencies, and besides, since this only explains what our user's will see in the upgrade, they don't see a vulun fix since the vulun code was not being used. Just change to deps: [email protected].
HISTORY.md
Outdated
| - Fix error when running under React Native | ||
| - Fix Inline extend function in node implementation | ||
| - Fix null reference check on window.documentElement.style.WebkitAppearance |
There was a problem hiding this comment.
Will our users actually experience this change? Looks like it only applies to web browsers, which this module doesn't function in.
There was a problem hiding this comment.
And it looks like that code is never executed under this module AFAIK.
HISTORY.md
Outdated
| - Fix error when running under React Native | ||
| - Fix Inline extend function in node implementation |
There was a problem hiding this comment.
Is this a typo ... "Fix Inline [...]" ?
`ms` patched the following vulnerability in v2.0.0 https://snyk.io/vuln/npm:ms:20170412 `debug` updated its `ms` dependency in v2.6.7. Supersedes expressjs#111
|
@dougwilson ready for another pass. |
mspatched the following vulnerability in v2.0.0 https://snyk.io/vuln/npm:ms:20170412debugupdated itsmsdependency in v2.6.7.Supersedes #111
Tracking: credential-handler/authn.io#48 digitalbazaar/bedrock-express#5