Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: update dependency shelljs to ^0.8.5 #600

Merged
merged 1 commit into from
Apr 25, 2024
Merged

Conversation

fasttime
Copy link
Member

@fasttime fasttime commented Apr 25, 2024

Versions of shelljs prior to v0.8.5 are affected by a high rated security vulnerability. Currently, users working with this repo will have version v0.3.0 installed, since that is the only version that matches the spec ^0.3.0. This PR updates package.json to ensure that only shelljs ^0.8.5 is used.

It also updates a unit test to use native Node.js API to read files.

NVD advisory: https://nvd.nist.gov/vuln/detail/CVE-2022-0144

Comment on lines -38 to -39
const output = shelljs.cat(`${filename}.result.json`);
const input = shelljs.cat(filename);
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This unit test was failing with a timeout on my macOS dev environment, probably because of the large size of the file tests/fixtures/libraries/angular-1.2.5.js.result.json. After switching to native Node.js API calls, all tests are passing again.

@fasttime fasttime marked this pull request as ready for review April 25, 2024 08:24
@fasttime fasttime changed the title chore: update dependency shelljs to v0.8.5 chore: update dependency shelljs to ^0.8.5 Apr 25, 2024
Copy link
Member

@aladdin-add aladdin-add left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!

@aladdin-add aladdin-add merged commit 18cfaca into main Apr 25, 2024
11 checks passed
@aladdin-add aladdin-add deleted the update-shelljs branch April 25, 2024 09:58
@github-actions github-actions bot mentioned this pull request Apr 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

2 participants