Skip to content
Sign up

john-peterson-g17/todo-app

public
00

A simple todo app

Upgrade form-data to 4.0.6 #1

Openg1tbot wants to merge g1t/security/form-data-4.0.6 into masterdependenciesjavascript

Other work is changing the same files

Whichever merges second will have to catch up, and may conflict.

g1tbotopened this pull request

Upgrades form-data (npm) from 4.0.0 to 4.0.6, which fixes these known vulnerabilities:

AdvisorySeverityAffectedFixed inSummary
GHSA-fjxv-7rqg-78g4critical4.0.04.0.4form-data uses unsafe random function in form-data for choosing boundary
GHSA-hmw2-7cc7-3qxxhigh4.0.04.0.6form-data: CRLF injection in form-data via unescaped multipart field names and filenames

Lockfiles changed: src/package-lock.json.

Only the version changes. This pull request lands through this branch's required checks like any other. If they fail because code has to change, g1t closes it and puts g1t on an issue to make the change.

Opened by g1t's security updates. Turn them off for this project on its Security page.

g1tbotadded the dependencies and javascript labels·
g1tbotcommented

Dependency review

Passed. 22 dependency changes, none vulnerable.

src/package-lock.json

ChangePackageVersionRelationshipLicenseVulnerabilities
Addedcall-bind-apply-helpers1.0.2transitive, developmentMITnone known
Addeddunder-proto1.0.1transitive, developmentMITnone known
Addedes-define-property1.0.1transitive, developmentMITnone known
Addedes-errors1.3.0transitive, developmentMITnone known
Addedes-object-atoms1.1.2transitive, developmentMITnone known
Addedes-set-tostringtag2.1.0transitive, developmentMITnone known
Addedform-data4.0.6transitive, developmentMITnone known
Addedfunction-bind1.1.2transitive, developmentMITnone known
Addedget-intrinsic1.3.0transitive, developmentMITnone known
Addedget-proto1.0.1transitive, developmentMITnone known
Addedgopd1.2.0transitive, developmentMITnone known
Addedhas-symbols1.1.0transitive, developmentMITnone known
Addedhas-tostringtag1.0.2transitive, developmentMITnone known
Addedhasown2.0.4transitive, developmentMITnone known
Addedmath-intrinsics1.1.0transitive, developmentMITnone known
Removedes-set-tostringtag2.0.1transitiveunknown
Removedform-data4.0.0transitiveunknown
Removedfunction-bind1.1.1transitiveunknown
Removedget-intrinsic1.2.1transitiveunknown
Removedgopd1.0.1transitiveunknown
Removedhas-symbols1.0.3transitiveunknown
Removedhas-tostringtag1.0.0transitiveunknown

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.

All checks have passed

2 passed · none are required, so none hold the merge

Workflows

Dependency review — 22 dependency changes, none vulnerableDetails
g1t / deploy — Preview is live

No reviews yet

Up to date with master

Sign in to comment.