Skip to content
Sign up

john-peterson-g17/todo-app

public
00

A simple todo app

Upgrade braces to 3.0.3 #8

Openg1tbot wants to merge g1t/security/braces-3.0.3 into masterdependenciesjavascript

Other work is changing the same files

Whichever merges second will have to catch up, and may conflict.

g1tbotopened this pull request

Upgrades braces (npm) from 3.0.2 to 3.0.3, which fixes these known vulnerabilities:

AdvisorySeverityAffectedFixed inSummary
GHSA-grv7-fg5c-xmjghigh3.0.23.0.3Uncontrolled resource consumption in braces
GHSA-vfj7-8cjw-p6xmhigh3.0.2none yetbraces vulnerable to stack-exhaustion denial of service through deeply nested patterns

Lockfiles changed: src/package-lock.json.

Only the version changes. This pull request lands through this branch's required checks like any other. If they fail because code has to change, g1t closes it and puts g1t on an issue to make the change.

Opened by g1t's security updates. Turn them off for this project on its Security page.

g1tbotadded the dependencies and javascript labels·
g1tbotcommented

Dependency review

Failed. Adds 1 vulnerable package.

src/package-lock.json

ChangePackageVersionRelationshipLicenseVulnerabilities
Addedbraces3.0.3transitive, developmentMITGHSA-vfj7-8cjw-p6xm high
Addedfill-range7.1.1transitive, developmentMITnone known
Removedbraces3.0.2transitiveunknown
Removedfill-range7.0.1transitiveunknown

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.

2 of 2 checks failed

2 failed · none are required, so none hold the merge

Workflows

Dependency review — Adds 1 vulnerable packageDetails
g1t / deploy — Deployment failedDetails

No reviews yet

Up to date with master

Sign in to comment.