Bump sha.js to 2.4.12 to fix cve#17736
Conversation
Signed-off-by: ivonaest <[email protected]>
|
We only use |
|
Build successful! You can test your changes in the REPL here: https://babeljs.io/repl/build/60687 |
|
commit: |
| "caniuse-lite": "1.0.30001766", | ||
| "core-js-compat": "3.48.0", | ||
| "electron-to-chromium": "1.5.278", | ||
| "sha.js": "2.4.12", |
There was a problem hiding this comment.
The resolutions here is not necessary, because the patched version 2.4.12 is well covered in the version spec such as ^2.4.0 and ^2.4.8. Could you run yarn up -R sha.js and stage the updated yarn.lock only?
There was a problem hiding this comment.
Done in the latest commit. Please let me know if this change works for you. Thank you
Signed-off-by: ivonaest <[email protected]>
Signed-off-by: ivonaest <[email protected]>
|
Hi @liuxingbaoyu , @JLHwung , @nicolo-ribaudo, thanks for feedback and merge. I am aware you are planning on removing Browserify but would you be interested in me opening another PR with similar approach for pbkdf2, cipher-base and elliptic dependencies. They are all coming from Browserify. Looking forward to your feedback |
|
I have removed it from #17229. |
Summary
Why:
To remove CVEs:
What:
Additional evidence
Partial output from security scanner Trivy:
Categorization