Skip to content

Commit 1a45e97

Browse files
fadi-quader-moxamgleitman
authored andcommitted
Bump 'async' from v2.4.2 to v3.2.2 to fix a prototype pollution exploit (facebook#802)
Summary: The PR is essentially to update [async](https://www.npmjs.com/package/async) to version [3.2.2](https://github.com/caolan/async/blob/master/CHANGELOG.md#v322) to fix t a [prototype pollution exploit](https://security.snyk.io/vuln/SNYK-JS-ASYNC-2441827) found in versions < `3.2.2` . The vulnerability was discovered by [Snyk](https://snyk.io/) has discovered an exploit in and labelled as **High Severity**. Changelog: [Internal] X-link: facebook/metro#802 Reviewed By: GijsWeterings Differential Revision: D35543054 Pulled By: robhogan fbshipit-source-id: b176c584dbcb139115e466a765e3efbe6f1f984d
1 parent 63267ab commit 1a45e97

File tree

2 files changed

+6
-1
lines changed

2 files changed

+6
-1
lines changed

repo-config/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
"@reactions/component": "^2.0.2",
1616
"@typescript-eslint/eslint-plugin": "4.30.0",
1717
"@typescript-eslint/parser": "4.30.0",
18-
"async": "^2.4.0",
18+
"async": "^3.2.2",
1919
"babel-eslint": "^10.1.0",
2020
"babel-preset-fbjs": "^3.4.0",
2121
"clang-format": "^1.2.4",

yarn.lock

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2005,6 +2005,11 @@ async@^2.4.0:
20052005
dependencies:
20062006
lodash "^4.17.14"
20072007

2008+
async@^3.2.2:
2009+
version "3.2.3"
2010+
resolved "https://registry.yarnpkg.com/async/-/async-3.2.3.tgz#ac53dafd3f4720ee9e8a160628f18ea91df196c9"
2011+
integrity sha512-spZRyzKL5l5BZQrr/6m/SqFdBN0q3OCI0f9rjfBzCMBIP4p75P620rR3gTmaksNOhmzgdxcaxdNfMy6anrbM0g==
2012+
20082013
asynckit@^0.4.0:
20092014
version "0.4.0"
20102015
resolved "https://registry.yarnpkg.com/asynckit/-/asynckit-0.4.0.tgz#c79ed97f7f34cb8f2ba1bc9790bcc366474b4b79"

0 commit comments

Comments
 (0)