fix: lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function
This commit is contained in:
		
							parent
							
								
									e40dc85438
								
							
						
					
					
						commit
						e4043bdfc2
					
				@ -50,7 +50,7 @@
 | 
			
		||||
    "gulp-typescript": "5.0.1",
 | 
			
		||||
    "less": "3.9.0",
 | 
			
		||||
    "less-plugin-npm-import": "2.1.0",
 | 
			
		||||
    "lodash": "4.17.19",
 | 
			
		||||
    "lodash": "^4.17.21",
 | 
			
		||||
    "rimraf": "2.6.3",
 | 
			
		||||
    "rollup": "2.33.3",
 | 
			
		||||
    "rollup-plugin-postcss": "3.1.8",
 | 
			
		||||
 | 
			
		||||
@ -9,7 +9,7 @@
 | 
			
		||||
  "dependencies": {
 | 
			
		||||
    "deepmerge": "^4.2.2",
 | 
			
		||||
    "koa-compose": "^4.1.0",
 | 
			
		||||
    "lodash": "^4.17.19",
 | 
			
		||||
    "lodash": "^4.17.21",
 | 
			
		||||
    "path-to-regexp": "^6.1.0",
 | 
			
		||||
    "qs": "^6.9.4"
 | 
			
		||||
  },
 | 
			
		||||
 | 
			
		||||
@ -12939,11 +12939,6 @@ lodash.uniq@^4.3.0, lodash.uniq@^4.5.0:
 | 
			
		||||
  resolved "https://registry.npmjs.org/lodash.uniq/-/lodash.uniq-4.5.0.tgz#d0225373aeb652adc1bc82e4945339a842754773"
 | 
			
		||||
  integrity sha1-0CJTc662Uq3BvILklFM5qEJ1R3M=
 | 
			
		||||
 | 
			
		||||
lodash@4.17.19:
 | 
			
		||||
  version "4.17.19"
 | 
			
		||||
  resolved "https://registry.npmjs.org/lodash/-/lodash-4.17.19.tgz#e48ddedbe30b3321783c5b4301fbd353bc1e4a4b"
 | 
			
		||||
  integrity sha512-JNvd8XER9GQX0v2qJgsaN/mzFCNA5BRe/j8JN9d+tWyGLSodKQHKFicdwNYzWwI3wjRnaKPsGj1XkBjx/F96DQ==
 | 
			
		||||
 | 
			
		||||
lodash@4.x, lodash@^4.17.11, lodash@^4.17.12, lodash@^4.17.14, lodash@^4.17.15, lodash@^4.17.19, lodash@^4.17.20, lodash@^4.17.21, lodash@^4.2.1, lodash@^4.7.0:
 | 
			
		||||
  version "4.17.21"
 | 
			
		||||
  resolved "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz#679591c564c3bffaae8454cf0b3df370c3d6911c"
 | 
			
		||||
 | 
			
		||||
		Loading…
	
		Reference in New Issue
	
	Block a user