From fecc3f149f5b663f1e9a7210da6884b0f55b4d2f Mon Sep 17 00:00:00 2001 From: Lucas Di Pentima Date: Fri, 23 Aug 2019 14:04:44 -0300 Subject: [PATCH] 15524: Upgrades lodash.template, lodash.mergewith & lodash-es. Addressing CVE-2019-10744. Arvados-DCO-1.1-Signed-off-by: Lucas Di Pentima --- package.json | 3 +++ yarn.lock | 20 +++++++++++++++++++- 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/package.json b/package.json index b8adb973..2aed781c 100644 --- a/package.json +++ b/package.json @@ -28,6 +28,9 @@ "jssha": "2.3.1", "jszip": "3.1.5", "lodash": "4.17.13", + "lodash-es": "4.17.14", + "lodash.mergewith": "4.6.2", + "lodash.template": "4.5.0", "react": "16.5.2", "react-copy-to-clipboard": "5.0.1", "react-dnd": "5.0.0", diff --git a/yarn.lock b/yarn.lock index 901ace1f..e5d1747e 100644 --- a/yarn.lock +++ b/yarn.lock @@ -5013,11 +5013,16 @@ locate-path@^2.0.0: p-locate "^2.0.0" path-exists "^3.0.0" +lodash-es@4.17.14: + version "4.17.14" + resolved "https://registry.yarnpkg.com/lodash-es/-/lodash-es-4.17.14.tgz#12a95a963cc5955683cee3b74e85458954f37ecc" + integrity sha512-7zchRrGa8UZXjD/4ivUWP1867jDkhzTG2c/uj739utSd7O/pFFdxspCemIFKEEjErbcqRzn8nKnGsi7mvTgRPA== + lodash-es@^4.17.10, lodash-es@^4.17.5, lodash-es@^4.2.1: version "4.17.11" resolved "https://registry.yarnpkg.com/lodash-es/-/lodash-es-4.17.11.tgz#145ab4a7ac5c5e52a3531fb4f310255a152b4be0" -lodash._reinterpolate@~3.0.0: +lodash._reinterpolate@^3.0.0, lodash._reinterpolate@~3.0.0: version "3.0.0" resolved "https://registry.yarnpkg.com/lodash._reinterpolate/-/lodash._reinterpolate-3.0.0.tgz#0ccf2d89166af03b3663c796538b75ac6e114d9d" @@ -5069,6 +5074,11 @@ lodash.memoize@^4.1.2: version "4.1.2" resolved "https://registry.yarnpkg.com/lodash.memoize/-/lodash.memoize-4.1.2.tgz#bcc6c49a42a2840ed997f323eada5ecd182e0bfe" +lodash.mergewith@4.6.2: + version "4.6.2" + resolved "https://registry.yarnpkg.com/lodash.mergewith/-/lodash.mergewith-4.6.2.tgz#617121f89ac55f59047c7aec1ccd6654c6590f55" + integrity sha512-GK3g5RPZWTRSeLSpgP8Xhra+pnjBC56q9FZYe1d5RN3TJ35dbkGy3YqBSMbyCrlbi+CM9Z3Jk5yTL7RCsqboyQ== + lodash.mergewith@^4.6.0: version "4.6.1" resolved "https://registry.yarnpkg.com/lodash.mergewith/-/lodash.mergewith-4.6.1.tgz#639057e726c3afbdb3e7d42741caa8d6e4335927" @@ -5081,6 +5091,14 @@ lodash.startswith@^4.2.1: version "4.2.1" resolved "https://registry.yarnpkg.com/lodash.startswith/-/lodash.startswith-4.2.1.tgz#c598c4adce188a27e53145731cdc6c0e7177600c" +lodash.template@4.5.0: + version "4.5.0" + resolved "https://registry.yarnpkg.com/lodash.template/-/lodash.template-4.5.0.tgz#f976195cf3f347d0d5f52483569fe8031ccce8ab" + integrity sha512-84vYFxIkmidUiFxidA/KjjH9pAycqW+h980j7Fuz5qxRtO9pgB7MDFTdys1N7A5mcucRiDyEq4fusljItR1T/A== + dependencies: + lodash._reinterpolate "^3.0.0" + lodash.templatesettings "^4.0.0" + lodash.template@^4.4.0: version "4.4.0" resolved "https://registry.yarnpkg.com/lodash.template/-/lodash.template-4.4.0.tgz#e73a0385c8355591746e020b99679c690e68fba0" -- 2.30.2