Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix Yard dependency vulnerability #184

Merged
merged 1 commit into from
Jul 31, 2019
Merged

Fix Yard dependency vulnerability #184

merged 1 commit into from
Jul 31, 2019

Conversation

joshcanhelp
Copy link
Contributor

Changes

Updates all dev dependencies. Fixes a vulnerability in [email protected]

References

From Snyk:

yard is a documentation generation tool for the Ruby programming language.

Affected versions of this package are vulnerable to Path Traversal. When using yard server to serve documentation the package would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level.

@joshcanhelp joshcanhelp requested a review from a team July 31, 2019 21:38
@joshcanhelp joshcanhelp added this to the v4.8.0 milestone Jul 31, 2019
lbalmaceda
lbalmaceda approved these changes Jul 31, 2019
View reviewed changes
Copy link
Contributor

@lbalmaceda lbalmaceda left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@joshcanhelp joshcanhelp merged commit edfa800 into master Jul 31, 2019
@joshcanhelp joshcanhelp deleted the update-yard-dep branch July 31, 2019 21:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@lbalmaceda lbalmaceda lbalmaceda approved these changes

Assignees
No one assigned
Labels
CH: Security
Projects
None yet
Milestone
v4.8.0
Development

Successfully merging this pull request may close these issues.
2 participants
@joshcanhelp @lbalmaceda