Skip to content

Commit a351801

Browse files
authored
fix(parse): enforce secure version of conventional-commits-parser (#2776)
Ensure that installing `@commitlint/parse` will not accidentally depend on an insecure version of `conventional-commits-parser` by requiring v3.22.2 or above as a dependency.
1 parent 1c91003 commit a351801

File tree

2 files changed

+12
-13
lines changed

2 files changed

+12
-13
lines changed

@commitlint/parse/package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040
"dependencies": {
4141
"@commitlint/types": "^13.1.0",
4242
"conventional-changelog-angular": "^5.0.11",
43-
"conventional-commits-parser": "^3.0.0"
43+
"conventional-commits-parser": "^3.2.2"
4444
},
4545
"gitHead": "70f7f4688b51774e7ac5e40e896cdaa3f132b2bc"
4646
}

yarn.lock

+11-12
Original file line numberDiff line numberDiff line change
@@ -4038,31 +4038,30 @@ conventional-commits-filter@^2.0.7:
40384038
lodash.ismatch "^4.4.0"
40394039
modify-values "^1.0.0"
40404040

4041-
conventional-commits-parser@^3.0.0:
4042-
version "3.0.8"
4043-
resolved "https://registry.npmjs.org/conventional-commits-parser/-/conventional-commits-parser-3.0.8.tgz#23310a9bda6c93c874224375e72b09fb275fe710"
4044-
integrity sha512-YcBSGkZbYp7d+Cr3NWUeXbPDFUN6g3SaSIzOybi8bjHL5IJ5225OSCxJJ4LgziyEJ7AaJtE9L2/EU6H7Nt/DDQ==
4041+
conventional-commits-parser@^3.2.0:
4042+
version "3.2.1"
4043+
resolved "https://registry.npmjs.org/conventional-commits-parser/-/conventional-commits-parser-3.2.1.tgz#ba44f0b3b6588da2ee9fd8da508ebff50d116ce2"
4044+
integrity sha512-OG9kQtmMZBJD/32NEw5IhN5+HnBqVjy03eC+I71I0oQRFA5rOgA4OtPOYG7mz1GkCfCNxn3gKIX8EiHJYuf1cA==
40454045
dependencies:
40464046
JSONStream "^1.0.4"
40474047
is-text-path "^1.0.1"
40484048
lodash "^4.17.15"
4049-
meow "^5.0.0"
4050-
split2 "^2.0.0"
4051-
through2 "^3.0.0"
4049+
meow "^8.0.0"
4050+
split2 "^3.0.0"
4051+
through2 "^4.0.0"
40524052
trim-off-newlines "^1.0.0"
40534053

4054-
conventional-commits-parser@^3.2.0:
4055-
version "3.2.1"
4056-
resolved "https://registry.npmjs.org/conventional-commits-parser/-/conventional-commits-parser-3.2.1.tgz#ba44f0b3b6588da2ee9fd8da508ebff50d116ce2"
4057-
integrity sha512-OG9kQtmMZBJD/32NEw5IhN5+HnBqVjy03eC+I71I0oQRFA5rOgA4OtPOYG7mz1GkCfCNxn3gKIX8EiHJYuf1cA==
4054+
conventional-commits-parser@^3.2.2:
4055+
version "3.2.2"
4056+
resolved "https://registry.npmjs.org/conventional-commits-parser/-/conventional-commits-parser-3.2.2.tgz#190fb9900c6e02be0c0bca9b03d57e24982639fd"
4057+
integrity sha512-Jr9KAKgqAkwXMRHjxDwO/zOCDKod1XdAESHAGuJX38iZ7ZzVti/tvVoysO0suMsdAObp9NQ2rHSsSbnAqZ5f5g==
40584058
dependencies:
40594059
JSONStream "^1.0.4"
40604060
is-text-path "^1.0.1"
40614061
lodash "^4.17.15"
40624062
meow "^8.0.0"
40634063
split2 "^3.0.0"
40644064
through2 "^4.0.0"
4065-
trim-off-newlines "^1.0.0"
40664065

40674066
conventional-recommended-bump@^6.1.0:
40684067
version "6.1.0"

0 commit comments

Comments
 (0)