Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: Upgrade lodash for prototype pollution fix #15678

Merged
merged 1 commit into from
Jul 13, 2019

Conversation

CYBAI
Copy link
Contributor

@CYBAI CYBAI commented Jul 13, 2019

Description

As reported by Snyk about the prototype pollution in lodash 4.17.11 and lower version, we should upgrade it to 4.17.14 version (https://github.com/lodash/lodash/issues/4348#issuecomment-509716822) which will fix the issue.

Note: Should I run yarn-deduplicate for lodash so that we can keep the dependency flat? (I was taught by @JLHwung about this in babel/babel#10191 (comment))

Related Issues

Related to #15621

@CYBAI CYBAI requested a review from a team as a code owner July 13, 2019 07:34
@moonmeister moonmeister changed the title Upgrade lodash to 4.17.14 chore(all): Upgrade lodash to 4.17.14 Jul 13, 2019
Copy link
Contributor

@sidharthachatterjee sidharthachatterjee left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you so much for this!

@sidharthachatterjee sidharthachatterjee changed the title chore(all): Upgrade lodash to 4.17.14 chore: Upgrade lodash for prototype pollution fix Jul 13, 2019
@sidharthachatterjee sidharthachatterjee merged commit e296939 into gatsbyjs:master Jul 13, 2019
@gatsbot
Copy link

gatsbot bot commented Jul 13, 2019

Holy buckets, @CYBAI — we just merged your PR to Gatsby! 💪💜

Gatsby is built by awesome people like you. Let us say “thanks” in two ways:

  1. We’d like to send you some Gatsby swag. As a token of our appreciation, you can go to the Gatsby Swag Store and log in with your GitHub account to get a coupon code good for one free piece of swag. We’ve got Gatsby t-shirts, stickers, hats, scrunchies, and much more. (You can also unlock even more free swag with 5 contributions — wink wink nudge nudge.) See gatsby.dev/swag for details.
  2. We just invited you to join the Gatsby organization on GitHub. This will add you to our team of maintainers. Accept the invite by visiting https://github.com/orgs/gatsbyjs/invitation. By joining the team, you’ll be able to label issues, review pull requests, and merge approved pull requests.

If there’s anything we can do to help, please don’t hesitate to reach out to us: tweet at @gatsbyjs and we’ll come a-runnin’.

Thanks again!

@CYBAI CYBAI deleted the lodash-upgrade branch July 14, 2019 02:07
madmonkey pushed a commit to madmonkey/gatsby that referenced this pull request Jul 15, 2019
johno pushed a commit to johno/gatsby that referenced this pull request Jul 17, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants