Skip to content

Conversation

@MikeMcC399
Copy link
Collaborator

Issue

Dependabot reports a high severity vulnerability CVE-2024-21538 in cross-spawn >= 7.0.0, < 7.0.5, patched in [email protected].

cross-spawn is a transient dependency of cypress

$ npm ls cross-spawn
[email protected]
└─┬ [email protected]
  └─┬ [email protected]
    └── [email protected]

where [email protected] requires cross-spawn@^7.0.0

Change

Update all usage of cross-spawn to [email protected] (current latest).

@MikeMcC399 MikeMcC399 added bug Something isn't working type: dependencies labels Nov 20, 2024
@MikeMcC399 MikeMcC399 self-assigned this Nov 20, 2024
@cypress-app-bot
Copy link

@MikeMcC399 MikeMcC399 marked this pull request as ready for review November 20, 2024 15:33
@AtofStryker AtofStryker merged commit 3b3f827 into cypress-io:master Nov 21, 2024
74 checks passed
@MikeMcC399 MikeMcC399 deleted the update/cross-spawn branch November 21, 2024 16:16
aayushshah15 pushed a commit to useblacksmith/cypress-io that referenced this pull request Dec 3, 2024
@github-actions
Copy link

github-actions bot commented Dec 9, 2024

🎉 This PR is included in version 6.7.8 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants