qunitjs/node-qunit

Bump version of istanbul?

Closed this issue · 4 comments

mmucklo commented

The old version of istanbul that gets pulled in seems to use an old version of handlebars that has a vulnerability:

handlebars 1.3.0 has known vulnerabilities:  severity: low; summary: Quoteless Attributes in Templates can lead to Content Injection; https://nodesecurity.io/advisories/61
[...]
qunit 0.9.0
 ↳ istanbul 0.2.5
  ↳ handlebars 1.3.0
kof commented

currently its using https://github.com/gotwarlost/istanbul/tree/harmony

Whats the latest version with harmony support?

maxbarrett commented

"the harmony branch should be treated as obsolete with the latest Istanbul release. The mainline release now has all the features that the harmony branch has."
gotwarlost/istanbul#284 (comment)

FYI, Istanbul v1.0.0-alpha.2 offers accurate coverage reporting of ES6 code.

Krinkle commented

Per https://github.com/gotwarlost/istanbul/blob/v0.4.5/CHANGELOG.md:

v0.3.9

  • Merge harmony branch and start adding ES6 features to istanbul
Krinkle commented

513c75f updates istanbul to v0.4.5 which comes with handlebars v4.0.6. The vulnerability was fixed in 4.0.0 per https://snyk.io/vuln/npm:handlebars.

qunit
+-- istanbul@0.4.5
| +-- handlebars@4.0.6