Skip to content

Commit

Permalink
Upgrade extract-zip to address vulnerability (#6845)
Browse files Browse the repository at this point in the history 
* Upgrade extract-zip to address vulnerability

Versions of extract-zip before `1.6.8` depended on a vulnerable version of `minimist` via `mkdirp`:

max-mapper/extract-zip#85 (comment)

Minimist vulnerability: https://app.snyk.io/vuln/SNYK-JS-MINIMIST-559764

* Update Yarn lockfile
  • Loading branch information
@karlhorky
karlhorky committed Mar 26, 2020
1 parent ee74c01 commit d7f6f61
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 25 deletions.
2 changes: 1 addition & 1 deletion cli/package.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@
"eventemitter2": "4.1.2",
"execa": "1.0.0",
"executable": "4.1.1",
"extract-zip": "1.6.7",
"extract-zip": "1.7.0",
"fs-extra": "8.1.0",
"getos": "3.1.4",
"is-ci": "2.0.0",
Expand Down
34 changes: 10 additions & 24 deletions yarn.lock
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8281,7 +8281,7 @@ concat-map@0.0.1:
resolved "https://registry.yarnpkg.com/concat-map/-/concat-map-0.0.1.tgz#d8a96bd77fd68df7793a73036a3ba0d5405d477b"
integrity sha1-2Klr13/Wjfd5OnMDajug1UBdR3s=

concat-stream@1.6.2, concat-stream@^1.4.7, concat-stream@^1.5.0, concat-stream@^1.5.2, concat-stream@^1.6.0, concat-stream@^1.6.1, concat-stream@~1.6.0:
concat-stream@^1.4.7, concat-stream@^1.5.0, concat-stream@^1.5.2, concat-stream@^1.6.0, concat-stream@^1.6.1, concat-stream@^1.6.2, concat-stream@~1.6.0:
version "1.6.2"
resolved "https://registry.yarnpkg.com/concat-stream/-/concat-stream-1.6.2.tgz#904bdf194cd3122fc675c77fc4ac3d4ff0fd1a34"
integrity sha512-27HBghJxjiZtIk3Ycvn/4kbJk/1uZuJFfuPEns6LaEvpvG1f0hTea8lilrouyo9mVc2GWdcEZ8OLoGmSADlrCw==
Expand Down Expand Up @@ -11089,14 +11089,14 @@ extract-text-webpack-plugin@4.0.0-beta.0:
webpack-sources "^1.1.0"

extract-zip@1.6.7, extract-zip@^1.0.3, extract-zip@^1.6.6:
version "1.6.7"
resolved "https://registry.yarnpkg.com/extract-zip/-/extract-zip-1.6.7.tgz#a840b4b8af6403264c8db57f4f1a74333ef81fe9"
integrity sha1-qEC0uK9kAyZMjbV/Txp0Mz74H+k=
version "1.7.0"
resolved "https://registry.yarnpkg.com/extract-zip/-/extract-zip-1.7.0.tgz#556cc3ae9df7f452c493a0cfb51cc30277940927"
integrity sha512-xoh5G1W/PB0/27lXgMQyIhP5DSY/LhoCsOyZgb+6iMmRtCwVBo55uKaMoEYrDCKQhWvqEip5ZPKAc6eFNyf/MA==
dependencies:
concat-stream "1.6.2"
debug "2.6.9"
mkdirp "0.5.1"
yauzl "2.4.1"
concat-stream "^1.6.2"
debug "^2.6.9"
mkdirp "^0.5.4"
yauzl "^2.10.0"

extsprintf@1.3.0:
version "1.3.0"
Expand Down Expand Up @@ -11235,13 +11235,6 @@ fd-slicer@1.1.0, fd-slicer@~1.1.0:
dependencies:
pend "~1.2.0"

fd-slicer@~1.0.1:
version "1.0.1"
resolved "https://registry.yarnpkg.com/fd-slicer/-/fd-slicer-1.0.1.tgz#8b5bcbd9ec327c5041bf9ab023fd6750f1177e65"
integrity sha1-i1vL2ewyfFBBv5qwI/1nUPEXfmU=
dependencies:
pend "~1.2.0"

fecha@^2.3.3:
version "2.3.3"
resolved "https://registry.yarnpkg.com/fecha/-/fecha-2.3.3.tgz#948e74157df1a32fd1b12c3a3c3cdcb6ec9d96cd"
Expand Down Expand Up @@ -16857,7 +16850,7 @@ mkdirp@0.3.0:
resolved "https://registry.yarnpkg.com/mkdirp/-/mkdirp-0.3.0.tgz#1bbf5ab1ba827af23575143490426455f481fe1e"
integrity sha1-G79asbqCevI1dRQ0kEJkVfSB/h4=

mkdirp@0.5, mkdirp@0.5.x, "mkdirp@>=0.5 0", mkdirp@^0.5.0, mkdirp@^0.5.1, mkdirp@^0.5.3, mkdirp@~0.5.0, mkdirp@~0.5.1:
mkdirp@0.5, mkdirp@0.5.x, "mkdirp@>=0.5 0", mkdirp@^0.5.0, mkdirp@^0.5.1, mkdirp@^0.5.3, mkdirp@^0.5.4, mkdirp@~0.5.0, mkdirp@~0.5.1:
version "0.5.4"
resolved "https://registry.yarnpkg.com/mkdirp/-/mkdirp-0.5.4.tgz#fd01504a6797ec5c9be81ff43d204961ed64a512"
integrity sha512-iG9AK/dJLtJ0XNgTuDbSyNS3zECqDlAhnQW4CsNxBG3LQJBbHmRX1egw39DmtOdCAqY+dKXV+sgPgilNWUKMVw==
Expand Down Expand Up @@ -25413,21 +25406,14 @@ yargs@~3.27.0:
window-size "^0.1.2"
y18n "^3.2.0"

yauzl@2.10.0:
yauzl@2.10.0, yauzl@^2.10.0:
version "2.10.0"
resolved "https://registry.yarnpkg.com/yauzl/-/yauzl-2.10.0.tgz#c7eb17c93e112cb1086fa6d8e51fb0667b79a5f9"
integrity sha1-x+sXyT4RLLEIb6bY5R+wZnt5pfk=
dependencies:
buffer-crc32 "~0.2.3"
fd-slicer "~1.1.0"

yauzl@2.4.1:
version "2.4.1"
resolved "https://registry.yarnpkg.com/yauzl/-/yauzl-2.4.1.tgz#9528f442dab1b2284e58b4379bb194e22e0c4005"
integrity sha1-lSj0QtqxsihOWLQ3m7GU4i4MQAU=
dependencies:
fd-slicer "~1.0.1"

yeast@0.1.2:
version "0.1.2"
resolved "https://registry.yarnpkg.com/yeast/-/yeast-0.1.2.tgz#008e06d8094320c372dbc2f8ed76a0ca6c8ac419"
Expand Down

4 comments on commit d7f6f61

@cypress-bot
Copy link
Contributor

@cypress-bot cypress-bot bot commented on d7f6f61 Mar 26, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Circle has built the linux x64 version of the Test Runner.

You can install this pre-release platform-specific build using instructions at https://on.cypress.io/installing-cypress#Install-pre-release-version.

You will need to use custom CYPRESS_INSTALL_BINARY url and install Cypress using an url instead of the version.

export CYPRESS_INSTALL_BINARY=https://cdn.cypress.io/beta/binary/4.2.1/linux-x64/circle-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-291477/cypress.zip
npm install https://cdn.cypress.io/beta/npm/4.2.1/circle-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-291462/cypress.tgz

@cypress-bot
Copy link
Contributor

@cypress-bot cypress-bot bot commented on d7f6f61 Mar 26, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AppVeyor has built the win32 ia32 version of the Test Runner.

You can install this pre-release platform-specific build using instructions at https://on.cypress.io/installing-cypress#Install-pre-release-version.

You will need to use custom CYPRESS_INSTALL_BINARY url and install Cypress using an url instead of the version.

Instructions are included below, depending on the shell you are using.

In Command Prompt (cmd.exe):

set CYPRESS_INSTALL_BINARY=https://cdn.cypress.io/beta/binary/4.2.1/win32-ia32/appveyor-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-31734623/cypress.zip
npm install https://cdn.cypress.io/beta/npm/4.2.1/appveyor-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-31734623/cypress.tgz

In PowerShell:

$env:CYPRESS_INSTALL_BINARY = https://cdn.cypress.io/beta/binary/4.2.1/win32-ia32/appveyor-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-31734623/cypress.zip
npm install https://cdn.cypress.io/beta/npm/4.2.1/appveyor-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-31734623/cypress.tgz

In Git Bash:

export CYPRESS_INSTALL_BINARY=https://cdn.cypress.io/beta/binary/4.2.1/win32-ia32/appveyor-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-31734623/cypress.zip
npm install https://cdn.cypress.io/beta/npm/4.2.1/appveyor-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-31734623/cypress.tgz

Using cross-env:

If the above commands do not work for you, you can also try using cross-env:

npm i -g cross-env
cross-env CYPRESS_INSTALL_BINARY=https://cdn.cypress.io/beta/binary/4.2.1/win32-ia32/appveyor-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-31734623/cypress.zip npm install https://cdn.cypress.io/beta/npm/4.2.1/appveyor-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-31734623/cypress.tgz

@cypress-bot
Copy link
Contributor

@cypress-bot cypress-bot bot commented on d7f6f61 Mar 26, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AppVeyor has built the win32 x64 version of the Test Runner.

You can install this pre-release platform-specific build using instructions at https://on.cypress.io/installing-cypress#Install-pre-release-version.

You will need to use custom CYPRESS_INSTALL_BINARY url and install Cypress using an url instead of the version.

Instructions are included below, depending on the shell you are using.

In Command Prompt (cmd.exe):

set CYPRESS_INSTALL_BINARY=https://cdn.cypress.io/beta/binary/4.2.1/win32-x64/appveyor-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-31734623/cypress.zip
npm install https://cdn.cypress.io/beta/npm/4.2.1/appveyor-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-31734623/cypress.tgz

In PowerShell:

$env:CYPRESS_INSTALL_BINARY = https://cdn.cypress.io/beta/binary/4.2.1/win32-x64/appveyor-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-31734623/cypress.zip
npm install https://cdn.cypress.io/beta/npm/4.2.1/appveyor-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-31734623/cypress.tgz

In Git Bash:

export CYPRESS_INSTALL_BINARY=https://cdn.cypress.io/beta/binary/4.2.1/win32-x64/appveyor-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-31734623/cypress.zip
npm install https://cdn.cypress.io/beta/npm/4.2.1/appveyor-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-31734623/cypress.tgz

Using cross-env:

If the above commands do not work for you, you can also try using cross-env:

npm i -g cross-env
cross-env CYPRESS_INSTALL_BINARY=https://cdn.cypress.io/beta/binary/4.2.1/win32-x64/appveyor-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-31734623/cypress.zip npm install https://cdn.cypress.io/beta/npm/4.2.1/appveyor-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-31734623/cypress.tgz

@cypress-bot
Copy link
Contributor

@cypress-bot cypress-bot bot commented on d7f6f61 Mar 26, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Circle has built the darwin x64 version of the Test Runner.

You can install this pre-release platform-specific build using instructions at https://on.cypress.io/installing-cypress#Install-pre-release-version.

You will need to use custom CYPRESS_INSTALL_BINARY url and install Cypress using an url instead of the version.

export CYPRESS_INSTALL_BINARY=https://cdn.cypress.io/beta/binary/4.2.1/darwin-x64/circle-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-291487/cypress.zip
npm install https://cdn.cypress.io/beta/npm/4.2.1/circle-develop-d7f6f61678ae92ad6916f6ca42dd4afd917a1e8d-291484/cypress.tgz

Please sign in to comment.