Publish a new release to fix security issue
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 1.9k
- Forks
- 51
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 1
Description
Our (Gitlab) based security scanner flagged up an issue in Execa 1.0.0, which was in our dependency chain via shx and shelljs. Shelljs was fixed in April (https://github.com/shelljs/shelljs/pull/1216) and it was updated in shx in May (https://github.com/shelljs/shx/commit/0f1ea07de7816304e8d1d8ebd7dc030e7cd6c7b0), fixing the security issue, but the latest release of shx (0.4.0) was done in March.
Please publish a new version so that any users of shx can update. It's not a huge security issue for us, it's just the security dashboard being a bit panicky.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by checking shx's current dependency metadata and release process, then verify the ShellJS and shx updates linked in the issue. Done means a new shx version containing the security fix is published for users to update.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- gitlab, javascript, node.js
- Domain
- release, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100