actions/msvc-dev-cmd
1
0
Fork 0
mirror of https://github.com/ilammy/msvc-dev-cmd.git synced 2026-09-06 21:57:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

Resolve audit warnings (#45)

Browse Source 
* Update glob-parent to resolve CVE-2020-28469

* Run audit tasks on Ubuntu runners (they are cheaper)

* Audit only production dependencies

That is, something that can actually affect users of this action.
I don't really want to be bothered with yet another "prototype pollution"
or "denial of service" in transitive dependencies of eslint.

* Audit dev-dependencies for critical vulnerabilities

That said, still audit development dependencies for critical
vulnerabilities if they come along. Hopefully, this should be rare.
This commit is contained in:
Alexei Lozovsky
2021-06-09 18:25:52 +09:00
committed by GitHub
parent af5661e514
commit 74a501b087
3 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package-lock.json
Generated
+6 -6
View File
@@ -531,9 +531,9 @@
}
},
"node_modules/glob-parent": {
"version": "5.1.0",
"resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.0.tgz",
"integrity": "sha512-qjtRgnIVmOfnKUE3NJAQEdk+lKrxfw8t5ke7SXtfMTHcjsBfOfWXCQfdb30zfDoZQ2IRSIiidmjtbHZPZ++Ihw==",
"version": "5.1.2",
"resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
"integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
"dev": true,
"dependencies": {
"is-glob": "^4.0.1"
@@ -1690,9 +1690,9 @@
}
},
"glob-parent": {
"version": "5.1.0",
"resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.0.tgz",
"integrity": "sha512-qjtRgnIVmOfnKUE3NJAQEdk+lKrxfw8t5ke7SXtfMTHcjsBfOfWXCQfdb30zfDoZQ2IRSIiidmjtbHZPZ++Ihw==",
"version": "5.1.2",
"resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
"integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
"dev": true,
"requires": {
"is-glob": "^4.0.1"