Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump imagemin-cli to 6.0.0 & other imagemin dependencies #531

Merged

Conversation

WilliamCollishaw
Copy link
Contributor

This fixes the following 3 low severity findings from running npm audit in the imagemin packages

# Run  npm install --save-dev [email protected]  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ imagemin-cli [dev]                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ imagemin-cli > meow > yargs-parser                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1500                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


# Run  npm update mkdirp --depth 4  to resolve 2 vulnerabilities
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ imagemin-cli [dev]                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ imagemin-cli > imagemin-svgo > svgo > mkdirp > minimist      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ imagemin-svgo [dev]                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ imagemin-svgo > svgo > mkdirp > minimist                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

The follow commands were used to make these changes:

npm install --save-dev [email protected]
npm update mkdirp --depth 4

@jmhobbs
Copy link
Owner

jmhobbs commented Dec 22, 2020

Thanks!

@jmhobbs jmhobbs merged commit 4f872c4 into jmhobbs:master Dec 22, 2020
@WilliamCollishaw WilliamCollishaw deleted the imagemin-low-severity-security-fixes branch December 22, 2020 17:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants