Skip to content

Commit

Permalink
Update dependencies including security incident
Browse files Browse the repository at this point in the history
This is the regular batch update for outdated dependencies and actually
the first one for this project.

Anyway, it is also a important update since it includes updates for the
hijacked package event-stream (1) that includes malicious code which has
been revealed yesterday (2). Nord Docs is affected passively because the
package is a a traverse dependency of the used package npm-run-all (3).
The maintainer has reacted quickly and released the fix version
4.1.55 (4).

Note that packages marked with `<!>` have been affected by the security
incident!

>>> Production Dependencies

- gatsby `2.0.50` -> `2.0.55` (5)
- gatsby-source-filesystem `2.0.8` -> `2.0.9` (6)

>>> Development Dependencies

- husky `1.1.4` -> `1.2.0` (7)
- lint-staged `8.0.5` -> `8.1.0` (8)
- npm-run-all `4.1.3` -> `4.1.50` (4) <!>

References:
  (1) https://www.npmjs.com/package/event-stream
  (2) https://snyk.io/blog/malicious-code-found-in-npm-package-event-stream
  (3) https://www.npmjs.com/package/npm-run-all
  (4) https://github.com/mysticatea/npm-run-all/releases/tag/v4.1.5
  (5) https://github.com/gatsbyjs/gatsby/blob/master/packages/gatsby/CHANGELOG.md#2055-2018-11-22
  (6) https://github.com/gatsbyjs/gatsby/blob/master/packages/gatsby-source-filesystem/CHANGELOG.md#209-2018-11-26
  (7) https://github.com/typicode/husky/blob/master/CHANGELOG.md#120
  (8)  https://github.com/okonet/lint-staged/releases/tag/v8.1.0

Resolves GH-47
  • Loading branch information
arcticicestudio committed Nov 27, 2018
1 parent 2d0000e commit 43204f0
Show file tree
Hide file tree
Showing 2 changed files with 293 additions and 502 deletions.
Loading

0 comments on commit 43204f0

Please sign in to comment.