Semantic-UI-CSS
Semantic-UI-CSS copied to clipboard
New release because of CVE-2019-11358
This CVE: https://nvd.nist.gov/vuln/detail/CVE-2019-11358 resulted in some security alerts in projects which use semantic-ui-css
This is caused by the jquery dependency.
Unfortunately you cannot easily update the depencendies because the dependency is to version x.*
"dependencies": {
"jquery": "x.*"
}
I had to update the yarn.lock files manually in several packages to update this dependency. (see https://github.com/Charterhouse/hush-hush/pull/6/commits/d74266128ccb2aa18fc9f88c097463ac72099b3c )
Can you make a new minor release (even without changes) so people can fix the problem by running: yarn upgrade-interactive?
Because they're specifying x.*, this doesn't actually require another release.
With npm, I've found that the following works:
- Remove
semantic-ui-cssfrompackage.json npm install- Add
semantic-ui-cssback npm install
Doesn't require any manual fiddling with package-lock.json or deleting node_modules. Hopefully a similar approach will work for folks on Yarn :)