Skip to content

Commit

Permalink
[[FIX]] Update Lodash to latest 4.17.19 (#3494)
Browse files Browse the repository at this point in the history
Address vulnerability of type "Prototype Pollution in lodash" GHSA-p6mc-m468-83gw

It is not sure whether this is at all relevant for jshint, but at the moment, GitHub's Dependabot sends vulnerability alerts to all respositories with a dependency to jshint, e.g.
https://github.com/alexandrainst/node-red-contrib-parser-ini/network/alert/package-lock.json/lodash/open

So it would be nice to issue a new jshint release ASAP to offer an easy way forward for those projects with a (dev) dependency to jshint.

https://github.com/lodash/lodash/wiki/Changelog
  • Loading branch information
Alkarex committed Jul 25, 2020
1 parent 1013d51 commit 17d8f5a
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion package.json
Expand Up @@ -44,7 +44,7 @@
"console-browserify": "1.1.x",
"exit": "0.1.x",
"htmlparser2": "3.8.x",
"lodash": "~4.17.11",
"lodash": "~4.17.19",
"minimatch": "~3.0.2",
"shelljs": "0.3.x",
"strip-json-comments": "1.0.x"
Expand Down

0 comments on commit 17d8f5a

Please sign in to comment.