[-]:fix/patch stack overflow vulnerability#1871
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
What about upgrading the package versions instead of adding them to resolutions? Can we do that or there is no new version for these packages that can fix that?
There was a problem hiding this comment.
I have been checking and upgrading isn't viable here @emotion/react, @emotion/styled, and react-select are already on their latest versions, no newer release that drops the yaml@1.x dependency. @svgr/webpack could be bumped from v6 to v8, but that's a major version with breaking changes, i prefer not doing for now.
|
2 participants
Adds Yarn resolutions to force yaml@1.10.3 for the four packages that transitively pull in the vulnerable yaml@1.x: