Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump xml2js to 0.5.0 #4389

Merged
merged 1 commit into from Apr 10, 2023
Merged

Bump xml2js to 0.5.0 #4389

merged 1 commit into from Apr 10, 2023

Conversation

mhassan1
Copy link
Contributor

This PR bumps xml2js to 0.5.0.

Resolves #4387.

Checklist
  • non-code related change (markdown/git settings etc)

@mhassan1 mhassan1 requested a review from a team as a code owner April 10, 2023 13:51
@trivikr
Copy link
Member

trivikr commented Apr 10, 2023

Verified that the vulnerability was fixed in dependency Leonidas-from-XIV/node-xml2js#663 (comment)

@trivikr trivikr changed the title chore(deps): bump xml2js to 0.5.0 Bump xml2js to 0.5.0 Apr 10, 2023
@trivikr trivikr merged commit 62847a4 into aws:master Apr 10, 2023
1 check passed
@mhassan1 mhassan1 deleted the bump-xml2js branch April 10, 2023 14:28
@ricardofaria-minu
Copy link

this fix has not been published on NPM.

@trivikr
Copy link
Member

trivikr commented Apr 10, 2023

this fix has not been published on NPM.

It will be published with aws-sdk@2.1354.0 today at around 11:30am Pacific.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

xml2js is vulnerable to prototype pollution(short issue description)
4 participants