Skip to content

Upgrade plist to v3.0.1 (CWE-400) - #19243

Closed
rajivshah3 wants to merge 1 commit into
react:masterfrom
rajivshah3:master
Closed

Upgrade plist to v3.0.1 (CWE-400)#19243
rajivshah3 wants to merge 1 commit into
react:masterfrom
rajivshah3:master

Conversation

@rajivshah3

@rajivshah3rajivshah3 commented May 13, 2018•
edited
Loading

Copy link
Copy Markdown
Contributor

Motivation

Upgrades plist to v3.0.1 as the current version (v1.2.0) is vulnerable to a Regex DoS: https://snyk.io/vuln/npm:plist:20180219

Test Plan

Not necessary

Release Notes

[GENERAL] [BUGFIX][package.json] Upgrade plist to v3.0.1

@rajivshah3
rajivshah3 requested a review from hramos as a code ownerMay 13, 2018 18:19
@facebook-github-botfacebook-github-bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label May 13, 2018
@react-native-botreact-native-bot added the Missing Changelog This PR appears to be missing a changelog, or they are incorrectly formatted. label May 13, 2018
@pull-bot

pull-bot commented May 13, 2018

Copy link
Copy Markdown
Warnings
⚠️

🔒 package.json - Changes were made to package.json. This will require a manual import by a Facebook employee.

⚠️

📋 Test Plan - This PR appears to be missing a Test Plan.

Generated by 🚫 dangerJS

@hramos

hramos commented May 14, 2018

Copy link
Copy Markdown
Contributor

Before I merge this, can you tell me why you think this does not need to be tested? Where is plist used? I am hesitant to land a PR that bumps a package by two major versions with no testing done.

@hramoshramos removed the Missing Changelog This PR appears to be missing a changelog, or they are incorrectly formatted. label May 14, 2018
@react-native-botreact-native-bot added Missing Changelog This PR appears to be missing a changelog, or they are incorrectly formatted. ✅Test Plan and removed ✅Test Plan labels May 14, 2018
@rajivshah3

rajivshah3 commented May 19, 2018

Copy link
Copy Markdown
ContributorAuthor

@hramos I interpreted "Test Plan" to mean whether any changes to the tests need to be made. I tested these changes using yarn test and all of the related tests passed successfully

@rajivshah3

rajivshah3 commented May 23, 2018

Copy link
Copy Markdown
ContributorAuthor

Closing in favor of #19373

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hramoshramosAwaiting requested review from hramos

Assignees

No one assigned

Labels

CLA SignedThis label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.Missing ChangelogThis PR appears to be missing a changelog, or they are incorrectly formatted.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@rajivshah3@pull-bot@hramos@facebook-github-bot@react-native-bot