commitizen / commitizen/cz-conventional-changelog
Vulnerability Prototype Pollution
- Dominant language
- JavaScript
- Stars
- 793
- Forks
- 444
- PR merge metrics
- No merged PRs in 30d
Description
A few days ago I went to install my project's packages and npm pointed out 4 critical security errors, but I couldn't understand the solution for it, I didn't find issues that matched the current problem, can you help me?
When running the command npm audit it shows the following text:
```
# npm audit report
merge <2.1.1
Severity: high
Prototype Pollution - https://npmjs.com/advisories/1666
fix available via `npm audit fix --force`
Will install cz-conventional-changelog@3.0.1, which is a breaking change
node_modules/merge
find-node-modules <=2.1.0
Depends on vulnerable versions of merge
node_modules/find-node-modules
commitizen >=2.0.0
Depends on vulnerable versions of cz-conventional-changelog
Depends on vulnerable versions of find-node-modules
node_modules/commitizen
cz-conventional-changelog >=3.0.2
Depends on vulnerable versions of commitizen
node_modules/commitizen/node_modules/cz-conventional-changelog
node_modules/cz-conventional-changelog
4 high severity vulnerabilities
To address all issues (including breaking changes), run:
npm audit fix --force
```
These are the versions that I have installed
cz-cli@4.2.3
cz-conventional-changelog@3.3.0
Thanks in advance for your help.
About this Vulnerability: https://www.npmjs.com/advisories/1666
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.