Skip to content
This repository was archived by the owner on Jan 18, 2022. It is now read-only.

chore: Upgrade rollup-pluginutils #271

Merged
merged 1 commit into from
Mar 6, 2019
Merged

chore: Upgrade rollup-pluginutils #271

merged 1 commit into from
Mar 6, 2019

Conversation

rkunev
Copy link

@rkunev rkunev commented Mar 5, 2019

Fixes N/A. I haven't logged it as an issue. Let me know if it's required!

Changes proposed in this pull request:

  • Upgrade rollup-pluginutils

Running yarn audit in a project using latest version of rollup-plugin-vue (at the time of writing 4.7.2) has 2 low level security issues. Both of which are a result of outdated rollup-pluginutils. Latest version of rollup-pluginutils is a minor upgrade and uses latest version of braces which doesn't have the "Regular Expression Denial of Service" issue. As for the "Cryptographically Weak PRNG" issue - braces package no longer depends on expand-rage.

I also ran the tests after upgrade, just for safe measure, and all tests passed.

yarn audit v1.13.0
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ braces                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.3.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ rollup-plugin-vue                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ rollup-plugin-vue > rollup-pluginutils > micromatch > braces │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/786                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Cryptographically Weak PRNG                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ randomatic                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.0.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ rollup-plugin-vue                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ rollup-plugin-vue > rollup-pluginutils > micromatch > braces │
│               │ > expand-range > fill-range > randomatic                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/157                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

/ping @znck

@znck znck merged commit 0b74c4a into vuejs:master Mar 6, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants