Update @manypkg/get-packages to ^2.2.2 to address GHSA-968p-4wvh-cqc8#1609
Update @manypkg/get-packages to ^2.2.2 to address GHSA-968p-4wvh-cqc8#1609Pewtro wants to merge 2 commits intochangesets:mainfrom
Conversation
🦋 Changeset detectedLatest commit: 8251b28 The changes in this PR will be included in the next version bump. This PR includes changesets to release 11 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Pewtro
force-pushed
the
chore/update-manypkg-get-packages
branch
from
f0e2460 to
2fc9ae9
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1609 +/- ##
=======================================
Coverage 81.16% 81.17%
=======================================
Files 54 54
Lines 2241 2247 +6
Branches 669 672 +3
=======================================
+ Hits 1819 1824 +5
- Misses 417 418 +1
Partials 5 5 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Pewtro
force-pushed
the
chore/update-manypkg-get-packages
branch
from
bc2d841 to
9cafe34
Compare
Pewtro
changed the title
|
This might not affect CLI consumers but for other packages this is a breaking change. |
|
Sure, bumped the changeset and added a link to v2.0.0 that brought along the breaking changes in the description |
|
It looks like the vulnerability is fixed in a babel patch, which should already be covered in our semver ranges, so I don't think we have to bump this to fix it. It would be good to update to latest in general though, but for breaking changes, we're currently focusing them in the If you can help review it when it's ready, that'll be much appreciated. For now I'll close this PR, thanks for contributing. |
3 participants
This fixes GHSA-968p-4wvh-cqc8 by updating to version 2 of
@manypkg/get-packageswhich had a few breaking changes, but as far as I could tell none of the breaking changes are exposed to consumers so I believe it can be released a patch version.I know that the vulnerability probably does not truly affect changesets, but github is flagging projects using changesets with the security alert, so I would assume you'll eventually get a lot of questions about it.