Backport of security patch, for benefit of yargs
See original GitHub issueI know it’s a pain in the neck, but would you consider back-porting https://github.com/chalk/ansi-regex/pull/37 to the 5.x.x release line, for the benefit of yargs.
Yargs is making the effort during the transition to ESM to support both CJS and ESM, which makes us unable to update to the latest version of string-width
.
If you were willing to make an exception (I know you’re pushing folks towards using ESM exclusively) it would be really valuable for yargs users using CJK character sets.
Issue Analytics
- State:
- Created 2 years ago
- Comments:30 (14 by maintainers)
Top Results From Across the Web
Backporting Security Patches of Web Applications: - USENIX
In this paper, we design a security patch backporting frame- work and implement a prototype on injection vulnerability patches, called SKYPORT.
Read more >Security Backporting Practice - Red Hat Customer Portal
For most products, our default practice is to backport security fixes, but we do sometimes provide version updates for some packages after careful...
Read more >Maintainers Should Consider Following Node.js' Release ...
It offers significant benefits to the community for library maintainers to follow this ... ensuring the ability to take security patches.
Read more >Inspections - Automattic/jetpack - Measure and Improve Code ...
Branch: update/backport-jp-10.0-changelog ... fix/do-not-display-security-dev-mode · update/deploy-to-master-stable · fix/apps-landing-images ...
Read more >Blog Archives - Page 20 of 24 - OpenJS Foundation
ensuring the ability to take security patches. reducing the burden on maintainers. allowing module authors to take advantage of new platform features sooner ......
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
GitHub Advisory Database still lists this package as affected for
<6.0.1
, here: https://github.com/advisories/GHSA-93q8-gq69-wqmwAnyone knows how to update that information as well?
This page https://docs.github.com/en/code-security/security-advisories/creating-a-security-advisory suggest the repo owner should be able to edit this information.
The range in the report says
<5.0.1
but it has not been proven that all versions below5.0.0
are vulnerable. (Snyk: You should generally not just assume all previous versions are affected by default).