Skip to content

bump cross-spawn version(s) to resolve vulnerability CVE-2024-21538 #52

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
jeffsays merged 19 commits into from
May 7, 2025
Merged

bump cross-spawn version(s) to resolve vulnerability CVE-2024-21538 #52

jeffsays merged 19 commits into from
May 7, 2025

Conversation

@rishi0508
Copy link
Contributor

@rishi0508 rishi0508 commented Jan 14, 2025 •
edited by jeffsays
Loading

Summary

What does this PR do?

Affected versions resolved versions
>= 7.0.0, < 7.0.5 7.0.5
<6.0.6 6.0.6

Details

Why did you make this change? What does it affect?
resolve vulnerabilities

Testing

How can the other reviewers check that your change works?

Before

 yarn why cross-spawn                                                    
├─ eslint@npm:8.57.1
│  └─ cross-spawn@npm:7.0.3 (via npm:^7.0.2)
│
├─ execa@npm:1.0.0
│  └─ cross-spawn@npm:6.0.5 (via npm:^6.0.0)
│
├─ execa@npm:4.1.0
│  └─ cross-spawn@npm:7.0.3 (via npm:^7.0.0)
│
├─ foreground-child@npm:3.3.0
│  └─ cross-spawn@npm:7.0.3 (via npm:^7.0.0)
│
└─ npm-run-all@npm:4.1.3
   └─ cross-spawn@npm:6.0.5 (via npm:^6.0.4)

After

yarn why cross-spawn
├─ @cumulusds/aws-cloudformation-wait-ready@workspace:.
│  └─ cross-spawn@npm:7.0.6 (via npm:^7.0.5)
│
├─ eslint@npm:8.57.1
│  └─ cross-spawn@npm:7.0.6 (via npm:^7.0.5)
│
├─ execa@npm:1.0.0
│  └─ cross-spawn@npm:7.0.6 (via npm:^7.0.5)
│
├─ execa@npm:4.1.0
│  └─ cross-spawn@npm:7.0.6 (via npm:^7.0.5)
│
├─ foreground-child@npm:3.3.0
│  └─ cross-spawn@npm:7.0.6 (via npm:^7.0.5)
│
└─ npm-run-all@npm:4.1.3
   └─ cross-spawn@npm:7.0.6 (via npm:^7.0.5)

@rishi0508 rishi0508 requested a review from jeffsays January 14, 2025 19:12
@rishi0508 rishi0508 self-assigned this Jan 14, 2025
@github-actions
Copy link

github-actions bot commented Jan 14, 2025 •
edited
Loading

yarn.lock changes

Summary

Status Count
ADDED 75
UPDATED 240
DOWNGRADED 4
REMOVED 172
Click to toggle table visibility
Name Status Previous Current
@babel/cli UPDATED 7.14.5 7.27.2
@babel/code-frame UPDATED 7.26.2 7.27.1
@babel/compat-data UPDATED 7.26.2 7.27.2
@babel/core UPDATED 7.16.10 7.27.1
@babel/generator UPDATED 7.26.2 7.27.1
@babel/helper-annotate-as-pure UPDATED 7.25.9 7.27.1
@babel/helper-builder-binary-assignment-operator-visitor REMOVED 7.0.0 -
@babel/helper-call-delegate REMOVED 7.0.0 -
@babel/helper-compilation-targets UPDATED 7.25.9 7.27.2
@babel/helper-create-class-features-plugin UPDATED 7.25.9 7.27.1
@babel/helper-create-regexp-features-plugin ADDED - 7.27.1
@babel/helper-define-map REMOVED 7.0.0 -
@babel/helper-define-polyfill-provider ADDED - 0.6.3
@babel/helper-environment-visitor REMOVED 7.22.20 -
@babel/helper-explode-assignable-expression REMOVED 7.0.0 -
@babel/helper-function-name REMOVED 7.23.0 -
@babel/helper-get-function-arity REMOVED 7.16.7 -
@babel/helper-hoist-variables REMOVED 7.22.5 -
@babel/helper-member-expression-to-functions UPDATED 7.25.9 7.27.1
@babel/helper-module-imports UPDATED 7.25.9 7.27.1
@babel/helper-module-transforms UPDATED 7.26.0 7.27.1
@babel/helper-optimise-call-expression UPDATED 7.25.9 7.27.1
@babel/helper-plugin-utils UPDATED 7.25.9 7.27.1
@babel/helper-regex REMOVED 7.0.0 -
@babel/helper-remap-async-to-generator UPDATED 7.0.0 7.27.1
@babel/helper-replace-supers UPDATED 7.25.9 7.27.1
@babel/helper-simple-access REMOVED 7.25.9 -
@babel/helper-skip-transparent-expression-wrappers UPDATED 7.25.9 7.27.1
@babel/helper-split-export-declaration REMOVED 7.22.6 -
@babel/helper-string-parser UPDATED 7.25.9 7.27.1
@babel/helper-validator-identifier UPDATED 7.25.9 7.27.1
@babel/helper-validator-option UPDATED 7.25.9 7.27.1
@babel/helper-wrap-function UPDATED 7.0.0 7.27.1
@babel/helpers UPDATED 7.26.0 7.27.1
@babel/highlight UPDATED 7.22.20 7.25.9
@babel/parser UPDATED 7.26.2 7.27.2
@babel/plugin-bugfix-firefox-class-in-computed-class-key ADDED - 7.27.1
@babel/plugin-bugfix-safari-class-field-initializer-scope ADDED - 7.27.1
@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression ADDED - 7.27.1
@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining ADDED - 7.27.1
@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly ADDED - 7.27.1
@babel/plugin-proposal-async-generator-functions REMOVED 7.0.0 -
@babel/plugin-proposal-json-strings REMOVED 7.0.0 -
@babel/plugin-proposal-nullish-coalescing-operator UPDATED 7.7.4 7.18.6
@babel/plugin-proposal-object-rest-spread REMOVED 7.0.0 -
@babel/plugin-proposal-optional-catch-binding REMOVED 7.0.0 -
@babel/plugin-proposal-private-property-in-object ADDED - 7.21.0-placeholder-for-preset-env.2
@babel/plugin-proposal-unicode-property-regex REMOVED 7.0.0 -
@babel/plugin-syntax-class-static-block ADDED - 7.14.5
@babel/plugin-syntax-import-assertions ADDED - 7.27.1
@babel/plugin-syntax-import-attributes ADDED - 7.27.1
@babel/plugin-syntax-jsx UPDATED 7.25.9 7.27.1
@babel/plugin-syntax-private-property-in-object ADDED - 7.14.5
@babel/plugin-syntax-typescript UPDATED 7.25.9 7.27.1
@babel/plugin-syntax-unicode-sets-regex ADDED - 7.18.6
@babel/plugin-transform-arrow-functions UPDATED 7.0.0 7.27.1
@babel/plugin-transform-async-generator-functions ADDED - 7.27.1
@babel/plugin-transform-async-to-generator UPDATED 7.0.0 7.27.1
@babel/plugin-transform-block-scoped-functions UPDATED 7.0.0 7.27.1
@babel/plugin-transform-block-scoping UPDATED 7.0.0 7.27.1
@babel/plugin-transform-class-properties ADDED - 7.27.1
@babel/plugin-transform-class-static-block ADDED - 7.27.1
@babel/plugin-transform-classes UPDATED 7.0.0 7.27.1
@babel/plugin-transform-computed-properties UPDATED 7.0.0 7.27.1
@babel/plugin-transform-destructuring UPDATED 7.0.0 7.27.1
@babel/plugin-transform-dotall-regex UPDATED 7.0.0 7.27.1
@babel/plugin-transform-duplicate-keys UPDATED 7.0.0 7.27.1
@babel/plugin-transform-duplicate-named-capturing-groups-regex ADDED - 7.27.1
@babel/plugin-transform-dynamic-import ADDED - 7.27.1
@babel/plugin-transform-exponentiation-operator UPDATED 7.0.0 7.27.1
@babel/plugin-transform-export-namespace-from ADDED - 7.27.1
@babel/plugin-transform-for-of UPDATED 7.0.0 7.27.1
@babel/plugin-transform-function-name UPDATED 7.0.0 7.27.1
@babel/plugin-transform-json-strings ADDED - 7.27.1
@babel/plugin-transform-literals UPDATED 7.0.0 7.27.1
@babel/plugin-transform-logical-assignment-operators ADDED - 7.27.1
@babel/plugin-transform-member-expression-literals ADDED - 7.27.1
@babel/plugin-transform-modules-amd UPDATED 7.0.0 7.27.1
@babel/plugin-transform-modules-commonjs UPDATED 7.25.9 7.27.1
@babel/plugin-transform-modules-systemjs UPDATED 7.0.0 7.27.1
@babel/plugin-transform-modules-umd UPDATED 7.0.0 7.27.1
@babel/plugin-transform-named-capturing-groups-regex ADDED - 7.27.1
@babel/plugin-transform-new-target UPDATED 7.0.0 7.27.1
@babel/plugin-transform-nullish-coalescing-operator ADDED - 7.27.1
@babel/plugin-transform-numeric-separator ADDED - 7.27.1
@babel/plugin-transform-object-rest-spread ADDED - 7.27.2
@babel/plugin-transform-object-super UPDATED 7.0.0 7.27.1
@babel/plugin-transform-optional-catch-binding ADDED - 7.27.1
@babel/plugin-transform-optional-chaining ADDED - 7.27.1
@babel/plugin-transform-parameters UPDATED 7.0.0 7.27.1
@babel/plugin-transform-private-methods ADDED - 7.27.1
@babel/plugin-transform-private-property-in-object ADDED - 7.27.1
@babel/plugin-transform-property-literals ADDED - 7.27.1
@babel/plugin-transform-regenerator UPDATED 7.0.0 7.27.1
@babel/plugin-transform-regexp-modifiers ADDED - 7.27.1
@babel/plugin-transform-reserved-words ADDED - 7.27.1
@babel/plugin-transform-shorthand-properties UPDATED 7.0.0 7.27.1
@babel/plugin-transform-spread UPDATED 7.0.0 7.27.1
@babel/plugin-transform-sticky-regex UPDATED 7.0.0 7.27.1
@babel/plugin-transform-template-literals UPDATED 7.0.0 7.27.1
@babel/plugin-transform-typeof-symbol UPDATED 7.0.0 7.27.1
@babel/plugin-transform-typescript UPDATED 7.25.9 7.27.1
@babel/plugin-transform-unicode-escapes ADDED - 7.27.1
@babel/plugin-transform-unicode-property-regex ADDED - 7.27.1
@babel/plugin-transform-unicode-regex UPDATED 7.0.0 7.27.1
@babel/plugin-transform-unicode-sets-regex ADDED - 7.27.1
@babel/preset-env UPDATED 7.0.0 7.27.2
@babel/preset-modules ADDED - 0.1.6-no-external-plugins
@babel/preset-typescript UPDATED 7.26.0 7.27.1
@babel/template UPDATED 7.25.9 7.27.2
@babel/traverse UPDATED 7.25.9 7.27.1
@babel/types UPDATED 7.26.0 7.27.1
@cnakazawa/watch REMOVED 1.0.4 -
@eslint-community/eslint-utils UPDATED 4.4.1 4.7.0
@jest/console UPDATED 26.6.2 29.7.0
@jest/core UPDATED 26.6.3 29.7.0
@jest/environment UPDATED 26.6.2 29.7.0
@jest/expect ADDED - 29.7.0
@jest/fake-timers UPDATED 26.6.2 29.7.0
@jest/globals UPDATED 26.6.2 29.7.0
@jest/reporters UPDATED 26.6.2 29.7.0
@jest/source-map UPDATED 26.6.2 29.6.3
@jest/test-result UPDATED 26.6.2 29.7.0
@jest/test-sequencer UPDATED 26.6.3 29.7.0
@jridgewell/gen-mapping UPDATED 0.3.5 0.3.8
@jridgewell/resolve-uri UPDATED 3.1.1 3.1.2
@jridgewell/sourcemap-codec UPDATED 1.4.15 1.5.0
@nicolo-ribaudo/chokidar-2 UPDATED 2.1.8-no-fsevents.2 2.1.8-no-fsevents.3
@pkgr/core UPDATED 0.1.1 0.2.4
@sinonjs/commons UPDATED 1.8.6 3.0.1
@sinonjs/fake-timers UPDATED 6.0.1 10.3.0
@tootallnate/once REMOVED 1.1.2 -
@types/babel__generator UPDATED 7.6.4 7.6.8
@types/babel__template UPDATED 7.4.1 7.4.4
@types/babel__traverse UPDATED 7.14.2 7.20.6
@types/gensync ADDED - 1.0.4
@types/istanbul-lib-coverage UPDATED 2.0.4 2.0.6
@types/istanbul-lib-report UPDATED 3.0.0 3.0.3
@types/istanbul-reports UPDATED 3.0.1 3.0.4
@types/node UPDATED 20.4.5 22.13.1
@types/normalize-package-data REMOVED 2.4.4 -
@types/prettier REMOVED 2.7.3 -
@types/semver ADDED - 7.5.8
@types/stack-utils UPDATED 2.0.1 2.0.3
@types/yargs-parser UPDATED 20.2.1 21.0.3
@typescript-eslint/eslint-plugin UPDATED 8.13.0 8.32.0
@typescript-eslint/parser UPDATED 8.13.0 8.32.0
@typescript-eslint/scope-manager UPDATED 8.13.0 8.32.0
@typescript-eslint/type-utils UPDATED 8.13.0 8.32.0
@typescript-eslint/types UPDATED 8.13.0 8.32.0
@typescript-eslint/typescript-estree UPDATED 8.13.0 8.32.0
@typescript-eslint/utils UPDATED 8.13.0 8.32.0
@typescript-eslint/visitor-keys UPDATED 8.13.0 8.32.0
@ungap/structured-clone UPDATED 1.2.0 1.3.0
abab REMOVED 2.0.6 -
abbrev UPDATED 2.0.0 3.0.0
acorn-globals REMOVED 6.0.0 -
acorn-walk REMOVED 7.2.0 -
anymatch UPDATED 3.1.2 3.1.3
arr-diff REMOVED 4.0.0 -
arr-flatten REMOVED 1.1.0 -
arr-union REMOVED 3.1.0 -
array-buffer-byte-length UPDATED 1.0.1 1.0.2
array-unique REMOVED 0.3.2 -
array.prototype.flat UPDATED 1.3.2 1.3.3
array.prototype.flatmap UPDATED 1.3.2 1.3.3
arraybuffer.prototype.slice UPDATED 1.0.3 1.0.4
assign-symbols REMOVED 1.0.0 -
async-each REMOVED 1.0.3 -
async-function ADDED - 1.0.0
asynckit REMOVED 0.4.0 -
atob REMOVED 2.1.2 -
aws-sdk UPDATED 2.1357.0 2.1692.0
babel-plugin-polyfill-corejs2 ADDED - 0.4.12
babel-plugin-polyfill-corejs3 ADDED - 0.11.1
babel-plugin-polyfill-regenerator ADDED - 0.6.3
babel-preset-current-node-syntax UPDATED 1.0.1 1.1.0
base REMOVED 0.11.2 -
binary-extensions UPDATED 2.1.0 2.3.0
browser-process-hrtime REMOVED 1.0.0 -
browserslist UPDATED 4.24.2 4.24.4
cache-base REMOVED 1.0.1 -
call-bind UPDATED 1.0.7 1.0.8
call-bind-apply-helpers ADDED - 1.0.1
call-bound ADDED - 1.0.3
caniuse-lite UPDATED 1.0.30001677 1.0.30001699
capture-exit REMOVED 2.0.0 -
chokidar UPDATED 3.5.2 3.6.0
cjs-module-lexer UPDATED 0.6.0 1.4.3
class-utils REMOVED 0.3.6 -
cliui UPDATED 6.0.0 8.0.1
collect-v8-coverage UPDATED 1.0.1 1.0.2
collection-visit REMOVED 1.0.0 -
colorette REMOVED 1.2.2 -
combined-stream REMOVED 1.0.8 -
component-emitter REMOVED 1.3.0 -
confusing-browser-globals UPDATED 1.0.9 1.0.11
copy-descriptor REMOVED 0.1.1 -
core-js-compat ADDED - 3.40.0
core-util-is REMOVED 1.0.3 -
create-jest ADDED - 29.7.0
cross-spawn UPDATED 7.0.3 7.0.6
cssom REMOVED 0.4.4 -
cssstyle REMOVED 2.3.0 -
data-urls REMOVED 2.0.0 -
data-view-buffer UPDATED 1.0.1 1.0.2
data-view-byte-length UPDATED 1.0.1 1.0.2
data-view-byte-offset UPDATED 1.0.0 1.0.1
debug UPDATED 4.3.7 4.4.0
decamelize REMOVED 1.2.0 -
decimal.js REMOVED 10.4.3 -
decode-uri-component REMOVED 0.2.2 -
dedent ADDED - 1.6.0
deepmerge UPDATED 4.2.2 4.3.1
define-property REMOVED 2.0.2 -
delayed-stream REMOVED 1.0.0 -
dezalgo UPDATED 1.0.3 1.0.4
domexception REMOVED 2.0.1 -
dunder-proto ADDED - 1.0.1
duplexer REMOVED 0.1.1 -
electron-to-chromium UPDATED 1.5.52 1.5.97
emittery UPDATED 0.7.2 0.13.1
es-abstract UPDATED 1.23.3 1.23.9
es-define-property UPDATED 1.0.0 1.0.1
es-object-atoms UPDATED 1.0.0 1.1.1
es-set-tostringtag UPDATED 2.0.3 2.1.0
es-to-primitive UPDATED 1.2.1 1.3.0
es6-object-assign REMOVED 1.1.0 -
escodegen REMOVED 2.1.0 -
eslint-config-airbnb-base UPDATED 14.0.0 15.0.0
eslint-plugin-jest UPDATED 28.9.0 28.11.0
eslint-plugin-prettier UPDATED 5.2.1 5.4.0
eslint-visitor-keys UPDATED 3.4.3 4.2.0
estraverse UPDATED 5.2.0 5.3.0
event-stream REMOVED 3.3.4 -
exec-sh REMOVED 0.3.6 -
execa UPDATED 4.1.0 5.1.1
expand-brackets REMOVED 2.1.4 -
exponential-backoff UPDATED 3.1.1 3.1.2
extend-shallow REMOVED 3.0.2 -
extglob REMOVED 2.0.4 -
fast-glob UPDATED 3.3.2 3.3.3
fastq UPDATED 1.17.1 1.19.0
fb-watchman UPDATED 2.0.1 2.0.2
flat-cache UPDATED 3.0.4 3.2.0
flatted UPDATED 3.2.2 3.3.2
for-each UPDATED 0.3.3 0.3.4
for-in REMOVED 1.0.2 -
form-data REMOVED 3.0.2 -
fragment-cache REMOVED 0.2.1 -
from REMOVED 0.1.7 -
fsevents UPDATED 2.3.2 2.3.3
function.prototype.name UPDATED 1.1.6 1.1.8
get-intrinsic UPDATED 1.2.4 1.2.7
get-proto ADDED - 1.0.1
get-stream UPDATED 5.2.0 6.0.1
get-symbol-description UPDATED 1.0.2 1.1.0
get-value REMOVED 2.0.6 -
git-describe UPDATED 4.0.4 4.1.1
gopd UPDATED 1.0.1 1.2.0
growly REMOVED 1.3.0 -
has REMOVED 1.0.3 -
has-bigints UPDATED 1.0.2 1.1.0
has-proto UPDATED 1.0.3 1.2.0
has-symbols UPDATED 1.0.3 1.1.0
has-value REMOVED 1.0.0 -
has-values REMOVED 1.0.0 -
html-encoding-sniffer REMOVED 2.0.1 -
human-signals UPDATED 1.1.1 2.1.0
import-fresh UPDATED 3.3.0 3.3.1
import-local UPDATED 3.1.0 3.2.0
internal-slot UPDATED 1.0.7 1.1.0
invariant REMOVED 2.2.4 -
is-accessor-descriptor REMOVED 1.0.0 -
is-arguments UPDATED 1.1.1 1.2.0
is-array-buffer UPDATED 3.0.4 3.0.5
is-async-function ADDED - 2.1.1
is-bigint UPDATED 1.0.4 1.1.0
is-boolean-object UPDATED 1.1.2 1.2.2
is-buffer REMOVED 1.1.6 -
is-ci REMOVED 2.0.0 -
is-core-module UPDATED 2.15.1 2.16.1
is-data-descriptor REMOVED 1.0.0 -
is-data-view UPDATED 1.0.1 1.0.2
is-date-object UPDATED 1.0.1 1.1.0
is-descriptor REMOVED 1.0.2 -
is-docker REMOVED 2.2.1 -
is-extendable REMOVED 1.0.1 -
is-finalizationregistry ADDED - 1.1.1
is-generator-function UPDATED 1.0.10 1.1.0
is-map ADDED - 2.0.3
is-negative-zero REMOVED 2.0.3 -
is-number-object UPDATED 1.0.7 1.1.1
is-plain-object REMOVED 2.0.4 -
is-potential-custom-element-name REMOVED 1.0.1 -
is-primitive REMOVED 3.0.1 -
is-regex UPDATED 1.1.4 1.2.1
is-set ADDED - 2.0.3
is-shared-array-buffer UPDATED 1.0.3 1.0.4
is-string UPDATED 1.0.7 1.1.1
is-symbol UPDATED 1.0.4 1.1.1
is-typed-array UPDATED 1.1.13 1.1.15
is-typedarray REMOVED 1.0.0 -
is-weakmap ADDED - 2.0.2
is-weakref UPDATED 1.0.2 1.1.1
is-weakset ADDED - 2.0.4
is-windows REMOVED 1.0.2 -
is-wsl REMOVED 2.2.0 -
isobject REMOVED 3.0.1 -
istanbul-lib-coverage UPDATED 3.2.0 3.2.2
istanbul-lib-instrument UPDATED 5.1.0 6.0.3
istanbul-lib-report UPDATED 3.0.0 3.0.1
jest UPDATED 26.6.3 29.7.0
jest-changed-files UPDATED 26.6.2 29.7.0
jest-circus ADDED - 29.7.0
jest-cli UPDATED 26.6.3 29.7.0
jest-config UPDATED 26.6.3 29.7.0
jest-docblock UPDATED 26.0.0 29.7.0
jest-each UPDATED 26.6.2 29.7.0
jest-environment-jsdom REMOVED 26.6.2 -
jest-environment-node UPDATED 26.6.2 29.7.0
jest-jasmine2 REMOVED 26.6.3 -
jest-leak-detector UPDATED 26.6.2 29.7.0
jest-mock UPDATED 26.6.2 29.7.0
jest-pnp-resolver UPDATED 1.2.2 1.2.3
jest-resolve UPDATED 26.6.2 29.7.0
jest-resolve-dependencies UPDATED 26.6.3 29.7.0
jest-runner UPDATED 26.6.3 29.7.0
jest-runtime UPDATED 26.6.3 29.7.0
jest-serializer REMOVED 26.6.2 -
jest-snapshot UPDATED 26.6.2 29.7.0
jest-validate UPDATED 26.6.2 29.7.0
jest-watcher UPDATED 26.6.2 29.7.0
js-levenshtein REMOVED 1.1.3 -
jsdom REMOVED 16.7.0 -
json-buffer ADDED - 3.0.1
keyv ADDED - 4.5.4
kind-of REMOVED 6.0.3 -
lodash.debounce ADDED - 4.0.8
loose-envify REMOVED 1.4.0 -
make-dir UPDATED 3.1.0 4.0.0
map-cache REMOVED 0.2.2 -
map-stream REMOVED 0.1.0 -
map-visit REMOVED 1.0.0 -
math-intrinsics ADDED - 1.1.0
mime-db REMOVED 1.52.0 -
mime-types REMOVED 2.1.35 -
mixin-deep REMOVED 1.3.2 -
nanomatch REMOVED 1.2.13 -
node-gyp UPDATED 11.0.0 11.1.0
node-notifier REMOVED 8.0.2 -
node-releases UPDATED 2.0.18 2.0.19
nopt UPDATED 8.0.0 8.1.0
npm-run-all UPDATED 4.1.3 4.1.5
nwsapi REMOVED 2.2.13 -
object-copy REMOVED 0.1.0 -
object-inspect UPDATED 1.13.2 1.13.4
object-visit REMOVED 1.0.1 -
object.assign UPDATED 4.1.5 4.1.7
object.entries UPDATED 1.1.0 1.1.8
object.pick REMOVED 1.3.0 -
object.values UPDATED 1.2.0 1.2.1
own-keys ADDED - 1.0.1
p-each-series REMOVED 2.2.0 -
parse5 REMOVED 6.0.1 -
pascalcase REMOVED 0.1.1 -
pause-stream REMOVED 0.0.11 -
pidtree ADDED - 0.3.1
posix-character-classes REMOVED 0.1.1 -
possible-typed-array-names UPDATED 1.0.0 1.1.0
prettier UPDATED 3.3.3 3.5.3
private REMOVED 0.1.8 -
process-nextick-args REMOVED 2.0.1 -
ps-tree REMOVED 1.1.0 -
psl REMOVED 1.9.0 -
pure-rand ADDED - 6.1.0
querystringify REMOVED 2.2.0 -
read-pkg DOWNGRADED 5.2.0 3.0.0
read-pkg-up REMOVED 7.0.1 -
readable-stream REMOVED 2.3.7 -
reflect.getprototypeof ADDED - 1.0.10
regenerate UPDATED 1.4.0 1.4.2
regenerate-unicode-properties UPDATED 7.0.0 10.2.0
regenerator-transform REMOVED 0.13.3 -
regex-not REMOVED 1.0.2 -
regexp.prototype.flags UPDATED 1.5.3 1.5.4
regexpu-core UPDATED 4.2.0 6.2.0
regjsgen UPDATED 0.4.0 0.8.0
regjsparser UPDATED 0.3.0 0.12.0
remove-trailing-separator REMOVED 1.1.0 -
repeat-element REMOVED 1.1.4 -
repeat-string REMOVED 1.6.1 -
require-main-filename REMOVED 2.0.0 -
requires-port REMOVED 1.0.0 -
resolve UPDATED 1.22.8 1.22.10
resolve-url REMOVED 0.2.1 -
resolve.exports ADDED - 2.0.3
ret REMOVED 0.1.15 -
rsvp REMOVED 4.8.5 -
safe-array-concat UPDATED 1.1.2 1.1.3
safe-buffer REMOVED 5.1.2 -
safe-push-apply ADDED - 1.0.0
safe-regex REMOVED 1.1.0 -
safe-regex-test UPDATED 1.0.3 1.1.0
sane REMOVED 4.1.0 -
saxes REMOVED 5.0.1 -
semver UPDATED 7.6.3 7.7.1
set-blocking REMOVED 2.0.0 -
set-proto ADDED - 1.0.0
set-value REMOVED 4.1.0 -
shell-quote UPDATED 1.7.3 1.8.2
shelljs UPDATED 0.8.5 0.9.2
shellwords REMOVED 0.1.1 -
shx UPDATED 0.3.2 0.4.0
side-channel UPDATED 1.0.6 1.1.0
side-channel-list ADDED - 1.0.0
side-channel-map ADDED - 1.0.1
side-channel-weakmap ADDED - 1.0.2
snapdragon REMOVED 0.8.2 -
snapdragon-node REMOVED 2.1.1 -
snapdragon-util REMOVED 3.0.1 -
socks UPDATED 2.8.3 2.8.4
source-map DOWNGRADED 0.7.4 0.6.1
source-map-resolve REMOVED 0.5.3 -
source-map-support DOWNGRADED 0.5.21 0.5.13
source-map-url REMOVED 0.4.1 -
spdx-correct UPDATED 3.1.1 3.2.0
spdx-exceptions UPDATED 2.3.0 2.5.0
spdx-license-ids UPDATED 3.0.11 3.0.21
split REMOVED 0.3.3 -
split-string REMOVED 3.1.0 -
static-extend REMOVED 0.1.2 -
stream-combiner REMOVED 0.0.4 -
string_decoder REMOVED 1.1.1 -
string.prototype.padend UPDATED 3.0.0 3.1.6
string.prototype.trim UPDATED 1.2.9 1.2.10
string.prototype.trimend UPDATED 1.0.8 1.0.9
supports-hyperlinks REMOVED 2.3.0 -
symbol-tree REMOVED 3.2.4 -
synckit UPDATED 0.9.2 0.11.4
terminal-link REMOVED 2.1.1 -
throat REMOVED 5.0.0 -
through REMOVED 2.3.8 -
to-fast-properties REMOVED 2.0.0 -
to-object-path REMOVED 0.3.0 -
to-regex REMOVED 3.0.2 -
tough-cookie REMOVED 4.1.4 -
tr46 REMOVED 2.1.0 -
ts-api-utils UPDATED 1.4.0 2.1.0
typed-array-buffer UPDATED 1.0.2 1.0.3
typed-array-byte-length UPDATED 1.0.1 1.0.3
typed-array-byte-offset UPDATED 1.0.2 1.0.4
typed-array-length UPDATED 1.0.6 1.0.7
typedarray-to-buffer REMOVED 3.1.5 -
typescript UPDATED 5.6.3 5.8.3
typescript-compiler UPDATED 1.4.1-2 1.4.1
unbox-primitive UPDATED 1.0.2 1.1.0
undici-types ADDED - 6.20.0
unicode-canonical-property-names-ecmascript UPDATED 1.0.4 2.0.1
unicode-match-property-ecmascript UPDATED 1.0.4 2.0.0
unicode-match-property-value-ecmascript UPDATED 1.0.2 2.2.0
unicode-property-aliases-ecmascript UPDATED 1.0.4 2.1.0
union-value REMOVED 1.0.1 -
universalify REMOVED 0.2.0 -
unset-value REMOVED 1.0.0 -
upath REMOVED 1.2.0 -
update-browserslist-db UPDATED 1.1.1 1.1.2
urix REMOVED 0.1.0 -
url-parse REMOVED 1.5.10 -
use REMOVED 3.1.1 -
util-deprecate REMOVED 1.0.2 -
uuid DOWNGRADED 8.3.2 8.0.0
v8-to-istanbul UPDATED 7.1.2 9.3.0
w3c-hr-time REMOVED 1.0.2 -
w3c-xmlserializer REMOVED 2.0.0 -
webidl-conversions REMOVED 6.1.0 -
whatwg-encoding REMOVED 1.0.5 -
whatwg-mimetype REMOVED 2.3.0 -
whatwg-url REMOVED 8.7.0 -
which-boxed-primitive UPDATED 1.0.2 1.1.1
which-builtin-type ADDED - 1.2.1
which-collection ADDED - 1.0.2
which-module REMOVED 2.0.1 -
which-typed-array UPDATED 1.1.15 1.1.18
ws REMOVED 7.5.10 -
xml-name-validator REMOVED 3.0.0 -
xml2js UPDATED 0.5.0 0.6.2
xmlchars REMOVED 2.2.0 -
y18n UPDATED 4.0.3 5.0.8
yargs UPDATED 15.4.1 17.7.2
yargs-parser UPDATED 18.1.3 21.1.1

@rishi0508 rishi0508 requested a review from only1chi January 14, 2025 21:23
only1chi
only1chi reviewed Jan 14, 2025
View reviewed changes
Copy link
Member

@only1chi only1chi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You may need to rerun the failed runs to get it to pass.

jeffsays
jeffsays reviewed Jan 15, 2025
View reviewed changes
@jeffsays jeffsays added the dependencies Pull requests that update a dependency file label Jan 23, 2025
@jeffsays jeffsays added this to the v1.2.1 milestone Jan 23, 2025
@rishi0508
Copy link
Contributor Author

rishi0508 commented Feb 4, 2025

After

yarn why cross-spawn
├─ @cumulusds/aws-cloudformation-wait-ready@workspace:.
│  └─ cross-spawn@npm:7.0.6 (via npm:^7.0.5)
│
├─ eslint@npm:8.57.1
│  └─ cross-spawn@npm:7.0.6 (via npm:^7.0.2)
│
├─ execa@npm:1.0.0
│  └─ cross-spawn@npm:6.0.6 (via npm:^6.0.0)
│
├─ execa@npm:4.1.0
│  └─ cross-spawn@npm:7.0.6 (via npm:^7.0.0)
│
├─ foreground-child@npm:3.3.0
│  └─ cross-spawn@npm:7.0.6 (via npm:^7.0.0)
│
└─ npm-run-all@npm:4.1.3
   └─ cross-spawn@npm:6.0.6 (via npm:^6.0.4)

@rishi0508 rishi0508 requested a review from jeffsays February 6, 2025 20:20
jeffsays
jeffsays requested changes Feb 6, 2025
View reviewed changes
package.json Outdated
"dependencies": {
"aws-sdk": "^2.536.0",
"chalk": "^3.0.0",
"cross-spawn": "^7.0.5",
Copy link
Contributor

@jeffsays jeffsays Feb 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"cross-spawn": "^7.0.5",

Remove and run yarn install again

@rishi0508 rishi0508 requested review from jeffsays and only1chi March 3, 2025 16:24
@jeffsays jeffsays merged commit c5d30a8 into master May 7, 2025
16 checks passed
@jeffsays jeffsays deleted the CVE-2024-21538 branch May 7, 2025 15:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jeffsays jeffsays Awaiting requested review from jeffsays

@only1chi only1chi Awaiting requested review from only1chi

Assignees

@rishi0508 rishi0508

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

v1.2.1

Development

Successfully merging this pull request may close these issues.

Upgrade cross-spawn to resolve CVE-2024-21538

4 participants

@rishi0508 @only1chi @jeffsays