Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[v5.2.x] Upgrade mkdirp to v0.5.5 #4224

Closed
wants to merge 1 commit into from
Closed

[v5.2.x] Upgrade mkdirp to v0.5.5 #4224

wants to merge 1 commit into from

Conversation

jayaddison
Copy link

Description of the Change

  • mkdirp: prototype pollution by minimist => update to mkdirp@0.5.5

Benefits

  • Reduction in npm audit and other vulnerability scanning noise for dependent projects

Alternate Designs

Replacing mkdirp with fs.mkdirSync as included in mocha v2.6.3 via #4200 might also have been possible.

That alternative approach does rely on nodejs v10.12.0, released 2018-10-10.

mocha v5.2.0 was released 2018-05-18 and states compatibility with node >= 4.0.

Applicable issues

Resolves #4220
Relates to #4204

@jayaddison jayaddison changed the title Upgrade mkdirp to v0.5.5 [v5.2.x] Upgrade mkdirp to v0.5.5 Apr 7, 2020
@coveralls
Copy link

Coverage Status

Coverage increased (+0.05%) to 90.054% when pulling 778c3a7 on jayaddison:update-mkdirp-5.2.x into 5bd33a0 on mochajs:release/v5.2.x.

@juergba
Copy link
Member

juergba commented Apr 7, 2020

@jayaddison Mocha@5 is almost two years old. We are not patching as far back and recommend to upgrade to Mocha@6 or Mocha@7.

@juergba juergba closed this Apr 7, 2020
@juergba juergba added the status: wontfix typically a feature which won't be added, or a "bug" which is actually intended behavior label Apr 7, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
status: wontfix typically a feature which won't be added, or a "bug" which is actually intended behavior
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants