boopathi/react-svg-loader

js-yaml advisory

dekaikiwi opened this issue · 6 comments

dekaikiwi commented

Is there any plan to update the version of js-yaml at all?

Currently yarn audit yields the following advisory.

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate      │ Denial of Service                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ js-yaml                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.13.0                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-svg-loader                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ react-svg-loader > react-svg-core > svgo > js-yaml           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/788                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
lasseborly commented

It seems to already be fixed in this commit: e8884d1

Would be ice to have a version out with the fix :)

  • 👍6
  • 🎉7
cakasuma commented

when will be the next release to fix this issue ?

  • 👍8
deregtd commented

Adding another request here for a release push!

  • 👍5
james-willett commented

Would be great if this could be pushed 😄

  • 👍2
michaelnyu commented

An additional request for a release push 💃 😄

boopathi commented

Published 3.0.0

  • 🎉2
  • ❤️1