Upgrade to npm 8.5.3 in 16.x to alleviate PRISMA-2022-0039 #42510
Labels
npm
Issues and PRs related to the npm client dependency or the npm registry.
Comments
targos
added
npm
4 tasks
2 tasks
ZainRizvi
added a commit
to pytorch/test-infra
that referenced
this issue
Nov 16, 2022
…dejs12 runtime (#1090) This PR contains two changes: 1. Fixes a security vuln with the minimatch package (identified by github). More details below 2. Upgrades the aws nodejs runtime past the now End-of-support nodejs12 runtime, which the tflint complained about after fixing the above security vuln # Package Dependency - Repository: [pytorch/test-infra](https://github.com/pytorch/test-infra) - Manifest file: [terraform-aws-github-runner/modules/webhook/lambdas/webhook/yarn.lock](https://github.com/pytorch/test-infra/blob/main/terraform-aws-github-runner/modules/webhook/lambdas/webhook/yarn.lock) - Package name: [minimatch](https://npmjs.com/package/minimatch) - Affected versions: < 3.0.5 - Fixed in version: 3.0.5 - Severity: HIGH # References https://nvd.nist.gov/vuln/detail/CVE-2022-3517 grafana/grafana-image-renderer#329 isaacs/minimatch@a8763f4 nodejs/node#42510 GHSA-f8q6-p94x-37v3
kit1980
pushed a commit
to pytorch/test-infra
that referenced
this issue
Nov 23, 2022
…dejs12 runtime (#1090) This PR contains two changes: 1. Fixes a security vuln with the minimatch package (identified by github). More details below 2. Upgrades the aws nodejs runtime past the now End-of-support nodejs12 runtime, which the tflint complained about after fixing the above security vuln # Package Dependency - Repository: [pytorch/test-infra](https://github.com/pytorch/test-infra) - Manifest file: [terraform-aws-github-runner/modules/webhook/lambdas/webhook/yarn.lock](https://github.com/pytorch/test-infra/blob/main/terraform-aws-github-runner/modules/webhook/lambdas/webhook/yarn.lock) - Package name: [minimatch](https://npmjs.com/package/minimatch) - Affected versions: < 3.0.5 - Fixed in version: 3.0.5 - Severity: HIGH # References https://nvd.nist.gov/vuln/detail/CVE-2022-3517 grafana/grafana-image-renderer#329 isaacs/minimatch@a8763f4 nodejs/node#42510 GHSA-f8q6-p94x-37v3
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Version
16.14.2
Platform
All
Subsystem
minimatch
What steps will reproduce the bug?
npm is on 8.5.0 and needs updating to latest npm 8.5.3 to remove the CVE in minimatch (PRISMA-2022-0039)
How often does it reproduce? Is there a required condition?
No response
What is the expected behavior?
No response
What do you see instead?
Need npm 8.5.3 in node 16.x
Additional information
No response
The text was updated successfully, but these errors were encountered: