-
Notifications
You must be signed in to change notification settings - Fork 1.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
security: updating semver to 7.5.4 to resolve CVE-2022-25883 #932
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
please go to 7.5.4.
When will this PR be merged and a new version of the module published? |
package.json
Outdated
@@ -39,7 +39,7 @@ | |||
"jws": "^3.2.2", | |||
"lodash": "^4.17.21", | |||
"ms": "^2.1.1", | |||
"semver": "^7.3.8" | |||
"semver": "^7.5.2" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
"semver": "^7.5.2" | |
"semver": "^7.5.4" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
3f875e9
to
dc01c79
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm. @david-renaud-okta can you give approval with write access:
Review required
At least 1 approving review is required by reviewers with write access.
@jakelacey2012 when will you merge into master? Thank you. |
You could have just removed semver https://github.com/auth0/node-jsonwebtoken/pull/880/files D'oh |
By submitting a PR to this repository, you agree to the terms within the Auth0 Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.
Description
This PR updates semver to a minimum version of 7.5.4 to resolve CVE-2022-25883.
References
Testing
npm test
is passing.Checklist