Merge pull request #3270 from bbc/security-fixes

Minimist updates to fix vulnerability
bbc · Mar 30, 2020 · b8ccb2f · b8ccb2f
2 parents 192e1b3 + 9826e8a
commit b8ccb2f
Show file tree

Hide file tree

Showing 24 changed files with 6,571 additions and 13,811 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,7 @@
 <!-- prettier-ignore -->
 | Version | Description |
 |---------|-------------|
+| 2.0.113 | [PR#3270](https://github.com/bbc/psammead/pull/3270) Security patch for `minimist` |
 | 2.0.112 | [PR#3311](https://github.com/bbc/psammead/pull/3311) Install @loadable/babel-plugin to support components using Loadable. |
 | 2.0.111 | [PR#3291](https://github.com/bbc/psammead/pull/3291) Bump `@psammead-storybook-helpers` |
 | 2.0.110 | [PR#3264](https://github.com/bbc/psammead/pull/3264) Add @bbc/psammead-live-label to dependencies |

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@bbc/psammead",
-  "version": "2.0.112",
+  "version": "2.0.113",
   "description": "Core Components Library Developed & Maintained By The Articles and Reach & Languages Team",
   "main": "index.js",
   "private": true,

diff --git a/packages/components/psammead-content-anchor/CHANGELOG.md b/packages/components/psammead-content-anchor/CHANGELOG.md
@@ -3,6 +3,7 @@
 <!-- prettier-ignore -->
 | Version | Description |
 |---------|-------------|
+| 1.0.0-alpha.4 | [PR#3270](https://github.com/bbc/psammead/pull/3270) Security fixes |
 | 1.0.0-alpha.3 | [PR#3151](https://github.com/bbc/psammead/pull/3151) Talos - Bump Dependencies - @bbc/psammead-headings |
 | 1.0.0-alpha.2 | [PR#3082](https://github.com/bbc/psammead/pull/3082) Talos - Bump Dependencies - @bbc/psammead-headings |
 | 1.0.0-alpha.1 | [PR#2582](https://github.com/bbc/psammead/pull/2582) Initial creation of package. |
diff --git a/packages/components/psammead-content-anchor/package-lock.json b/packages/components/psammead-content-anchor/package-lock.json
diff --git a/packages/components/psammead-content-anchor/package.json b/packages/components/psammead-content-anchor/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@bbc/psammead-content-anchor",
-  "version": "1.0.0-alpha.3",
+  "version": "1.0.0-alpha.4",
   "main": "dist/index.js",
   "module": "esm/index.js",
   "sideEffects": false,

diff --git a/packages/containers/psammead-timestamp-container/CHANGELOG.md b/packages/containers/psammead-timestamp-container/CHANGELOG.md
@@ -3,6 +3,7 @@
 <!-- prettier-ignore -->
 | Version | Description |
 |---------|-------------|
+| 2.7.10 | [PR#3270](https://github.com/bbc/psammead/pull/3270) Security fixes |
 | 2.7.9 | [PR#3273](https://github.com/bbc/psammead/pull/3273) Talos - Bump Dependencies - @bbc/psammead-locales |
 | 2.7.8 | [PR#3271](https://github.com/bbc/psammead/pull/3271) Talos - Bump Dependencies - @bbc/psammead-locales |
 | 2.7.7 | [PR#3137](https://github.com/bbc/psammead/pull/3137) Fix P3 a11y bug degrading iOS Voice Over UX |

diff --git a/packages/containers/psammead-timestamp-container/package-lock.json b/packages/containers/psammead-timestamp-container/package-lock.json
diff --git a/packages/containers/psammead-timestamp-container/package.json b/packages/containers/psammead-timestamp-container/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@bbc/psammead-timestamp-container",
-  "version": "2.7.9",
+  "version": "2.7.10",
   "main": "dist/index.js",
   "module": "esm/index.js",
   "sideEffects": false,

diff --git a/packages/utilities/moment-timezone-include/CHANGELOG.md b/packages/utilities/moment-timezone-include/CHANGELOG.md
@@ -3,6 +3,7 @@
 <!-- prettier-ignore -->
 | Version | Description |
 | ------- | ----------- |
+| 1.1.4 | [PR#3270](https://github.com/bbc/psammead/pull/3270) Add EOF lines |
 | 1.1.3 | [PR#3266](https://github.com/bbc/psammead/pull/3266) Update version `mkdirp` to remove `minimist` vulnerability |
 | 1.1.2 | [PR#1960](https://github.com/bbc/psammead/pull/1960) Use object spread syntax instead of object.assign |
 | 1.1.1 | [PR#1803](https://github.com/bbc/psammead/pull/1803/) Patches broken links on badges in documentation |

diff --git a/packages/utilities/moment-timezone-include/package-lock.json b/packages/utilities/moment-timezone-include/package-lock.json
diff --git a/packages/utilities/moment-timezone-include/package.json b/packages/utilities/moment-timezone-include/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@bbc/moment-timezone-include",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "description": "Webpack plugin and timezone data includes to pull in specific timezone data into desired chunks.",
   "main": "./dist/index.js",
   "repository": {
@@ -35,4 +35,4 @@
     "object-hash": "^1.3.1",
     "moment-timezone": "^0.5.26"
   }
-}
+}
diff --git a/packages/utilities/psammead-calendars/CHANGELOG.md b/packages/utilities/psammead-calendars/CHANGELOG.md
@@ -1,7 +1,9 @@
 # Psammead Calendars Changelog
 
+<!-- prettier-ignore -->
 | Version | Description |
 |---------|-------------|
+| 2.0.9 | [PR#3270](https://github.com/bbc/psammead/pull/3270) Security fixes |
 | 2.0.8 | [PR#3273](https://github.com/bbc/psammead/pull/3273) Talos - Bump Dependencies - @bbc/psammead-locales |
 | 2.0.7 | [PR#3271](https://github.com/bbc/psammead/pull/3271) Talos - Bump Dependencies - @bbc/psammead-locales |
 | 2.0.6 | [PR#3082](https://github.com/bbc/psammead/pull/3082) Talos - Bump Dependencies - @bbc/psammead-locales |

diff --git a/packages/utilities/psammead-calendars/package-lock.json b/packages/utilities/psammead-calendars/package-lock.json
diff --git a/packages/utilities/psammead-calendars/package.json b/packages/utilities/psammead-calendars/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@bbc/psammead-calendars",
-  "version": "2.0.8",
+  "version": "2.0.9",
   "main": "dist/index.js",
   "module": "esm/index.js",
   "sideEffects": false,

diff --git a/packages/utilities/psammead-rich-text-transforms/CHANGELOG.md b/packages/utilities/psammead-rich-text-transforms/CHANGELOG.md
@@ -3,6 +3,7 @@
 <!-- prettier-ignore -->
 | Version | Description |
 | ------- | ----------- |
+| 2.0.1 | [PR#3270](https://github.com/bbc/psammead/pull/3270) Fix `minimist` and `acorn` vulnerability |
 | 2.0.0 | [PR#2556](https://github.com/bbc/psammead/pull/2556) Tightened conditions for a link to be considered external |
 | 1.1.2 | [PR#2466](https://github.com/bbc/psammead/pull/2466) Package-lock updates |
 | 1.1.1 | [PR#2495](https://github.com/bbc/psammead/pull/2495) Replaces `node.constructor.name` logic as it caused a bug on client-side code execution |