{{ message }}
Repository navigation
Synk Vulnerability SNYK-JS-Y18N-1021887 transitively in @angular/localize #39743
Description
🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑
Please read https://angular.io/guide/security#report-issues on how to disclose security related issues.
🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑
Issue is not directly in angular code, so creating issue as opposed to following the link above.
Problem: @angular/localize v10.2.3 and v9.1.12 both use yargs@15.13.0, which in turn uses y18n@^4.0.0. y18n has the following Prototype Pollution synk vulnerability, with a remediation of upgrading y18n to v5..0.5 or higher.
yargs@16.1.1 upgrades to y18n@^5.0.5. Is it possible to update the 9.x and 10.x lines of @angular/localize to use this higher version of yargs?
Activity
gauravshah27 commentedon Nov 18, 2020
I am hitting the same issue on my angular project. Any solution?
petebacondarwin commentedon Nov 18, 2020
This sounds like a reasonable request. I will put together a PR today.
build: update to latest "yargs" package
build: update to latest "yargs" package
build: update to latest "yargs" package (#39749)
build: update to latest "yargs" package
angular-automatic-lock-bot commentedon Dec 20, 2020
This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.
Read more about our automatic conversation locking policy.
This action has been performed automatically by a bot.