ruiling/tachybase_todo
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function

Browse Source
This commit is contained in:
chenos 2021-10-14 14:37:41 +08:00
parent e40dc85438
commit e4043bdfc2
3 changed files with 2 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
packages/father-build/package.json
View File

@ -50,7 +50,7 @@
"gulp-typescript": "5.0.1",
"less": "3.9.0",
"less-plugin-npm-import": "2.1.0",
"lodash": "4.17.19",
"lodash": "^4.17.21",
"rimraf": "2.6.3",
"rollup": "2.33.3",
"rollup-plugin-postcss": "3.1.8",

2
packages/resourcer/package.json
View File

@ -9,7 +9,7 @@
"dependencies": {
"deepmerge": "^4.2.2",
"koa-compose": "^4.1.0",
"lodash": "^4.17.19",
"lodash": "^4.17.21",
"path-to-regexp": "^6.1.0",
"qs": "^6.9.4"
},

5
yarn.lock
View File

@ -12939,11 +12939,6 @@ lodash.uniq@^4.3.0, lodash.uniq@^4.5.0:
resolved "https://registry.npmjs.org/lodash.uniq/-/lodash.uniq-4.5.0.tgz#d0225373aeb652adc1bc82e4945339a842754773"
integrity sha1-0CJTc662Uq3BvILklFM5qEJ1R3M=
lodash@4.17.19:
version "4.17.19"
resolved "https://registry.npmjs.org/lodash/-/lodash-4.17.19.tgz#e48ddedbe30b3321783c5b4301fbd353bc1e4a4b"
integrity sha512-JNvd8XER9GQX0v2qJgsaN/mzFCNA5BRe/j8JN9d+tWyGLSodKQHKFicdwNYzWwI3wjRnaKPsGj1XkBjx/F96DQ==
lodash@4.x, lodash@^4.17.11, lodash@^4.17.12, lodash@^4.17.14, lodash@^4.17.15, lodash@^4.17.19, lodash@^4.17.20, lodash@^4.17.21, lodash@^4.2.1, lodash@^4.7.0:
version "4.17.21"
resolved "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz#679591c564c3bffaae8454cf0b3df370c3d6911c"