New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

security(npm): lock colors library to 1.4.0 #81

Closed

DragonStuff wants to merge 1 commit into main from SEC-INTERNAL/lock-colors

Contributor

DragonStuff commented Jan 10, 2022 •

edited

The maintainer has intentionally published a DoS in 1.4.1 and higher. It is recommended to lock to 1.4.0 and move to another package.

This pull request makes the following changes:

locks colors.js to 1.4.0 by upgrading @storybook/react as per the maintainer's reaction.
@storybook/core-server pins cli-table3 to v0.6.0, which prevents upgrades to v0.6.1, which includes a security fix storybookjs/storybook#17179

It relates to the following issue #s:

Fixes security(npm): colors.js has embedded denial of service #79


          security(npm): lock colors library to 1.4.0

cf5da99

#79

DragonStuff closed this

DragonStuff deleted the SEC-INTERNAL/lock-colors branch

January 10, 2022 15:12

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment