From e4043bdfc2fc374f3c865368958b7f848be53700 Mon Sep 17 00:00:00 2001 From: chenos Date: Thu, 14 Oct 2021 14:37:41 +0800 Subject: [PATCH] fix: lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function --- packages/father-build/package.json | 2 +- packages/resourcer/package.json | 2 +- yarn.lock | 5 ----- 3 files changed, 2 insertions(+), 7 deletions(-) diff --git a/packages/father-build/package.json b/packages/father-build/package.json index 580ad77ed..cf46b767b 100755 --- a/packages/father-build/package.json +++ b/packages/father-build/package.json @@ -50,7 +50,7 @@ "gulp-typescript": "5.0.1", "less": "3.9.0", "less-plugin-npm-import": "2.1.0", - "lodash": "4.17.19", + "lodash": "^4.17.21", "rimraf": "2.6.3", "rollup": "2.33.3", "rollup-plugin-postcss": "3.1.8", diff --git a/packages/resourcer/package.json b/packages/resourcer/package.json index 4124da529..4f709ca23 100644 --- a/packages/resourcer/package.json +++ b/packages/resourcer/package.json @@ -9,7 +9,7 @@ "dependencies": { "deepmerge": "^4.2.2", "koa-compose": "^4.1.0", - "lodash": "^4.17.19", + "lodash": "^4.17.21", "path-to-regexp": "^6.1.0", "qs": "^6.9.4" }, diff --git a/yarn.lock b/yarn.lock index 9e36055ee..0a90389e3 100644 --- a/yarn.lock +++ b/yarn.lock @@ -12939,11 +12939,6 @@ lodash.uniq@^4.3.0, lodash.uniq@^4.5.0: resolved "https://registry.npmjs.org/lodash.uniq/-/lodash.uniq-4.5.0.tgz#d0225373aeb652adc1bc82e4945339a842754773" integrity sha1-0CJTc662Uq3BvILklFM5qEJ1R3M= -lodash@4.17.19: - version "4.17.19" - resolved "https://registry.npmjs.org/lodash/-/lodash-4.17.19.tgz#e48ddedbe30b3321783c5b4301fbd353bc1e4a4b" - integrity sha512-JNvd8XER9GQX0v2qJgsaN/mzFCNA5BRe/j8JN9d+tWyGLSodKQHKFicdwNYzWwI3wjRnaKPsGj1XkBjx/F96DQ== - lodash@4.x, lodash@^4.17.11, lodash@^4.17.12, lodash@^4.17.14, lodash@^4.17.15, lodash@^4.17.19, lodash@^4.17.20, lodash@^4.17.21, lodash@^4.2.1, lodash@^4.7.0: version "4.17.21" resolved "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz#679591c564c3bffaae8454cf0b3df370c3d6911c"