commitizen / commitizen/cz-conventional-changelog

Vulnerability Prototype Pollution

Open
#142 2 comments 4 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
793
Forks
444
PR merge metrics
No merged PRs in 30d

Description

A few days ago I went to install my project's packages and npm pointed out 4 critical security errors, but I couldn't understand the solution for it, I didn't find issues that matched the current problem, can you help me?

When running the command npm audit it shows the following text:
```
# npm audit report

merge <2.1.1
Severity: high
Prototype Pollution - https://npmjs.com/advisories/1666
fix available via `npm audit fix --force`
Will install cz-conventional-changelog@3.0.1, which is a breaking change
node_modules/merge
find-node-modules <=2.1.0
Depends on vulnerable versions of merge
node_modules/find-node-modules
commitizen >=2.0.0
Depends on vulnerable versions of cz-conventional-changelog
Depends on vulnerable versions of find-node-modules
node_modules/commitizen
cz-conventional-changelog >=3.0.2
Depends on vulnerable versions of commitizen
node_modules/commitizen/node_modules/cz-conventional-changelog
node_modules/cz-conventional-changelog

4 high severity vulnerabilities

To address all issues (including breaking changes), run:
npm audit fix --force
```

These are the versions that I have installed
cz-cli@4.2.3
cz-conventional-changelog@3.3.0

Thanks in advance for your help.

About this Vulnerability: https://www.npmjs.com/advisories/1666

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.