Skip to content

Commit ded90c6

Browse files
committed
chore(deps) use resolutions for hawk.
We were exposed to vulnerabilities in `hoek` and `cryptiles` via our dependency on `ember-cli-update`. The dependency chain is: ember-cli-update boilerplate-update npx npm (→ node-gyp) request hawk cryptiles hoek (also via others under hawk) Pinning `hawk` to a recent version correctly bumps these versions.
1 parent 258d42a commit ded90c6

File tree

2 files changed

+55
-28
lines changed

2 files changed

+55
-28
lines changed

package.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,8 @@
112112
},
113113
"resolutions": {
114114
"@types/ember": "3.0.29",
115-
"@types/ember__string": "3.0.6"
115+
"@types/ember__string": "3.0.6",
116+
"hawk": "7"
116117
},
117118
"engines": {
118119
"node": "6.* || 8.* || >= 10.*"

yarn.lock

Lines changed: 53 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1500,6 +1500,13 @@ aws4@^1.2.1, aws4@^1.8.0:
15001500
resolved "https://registry.yarnpkg.com/aws4/-/aws4-1.8.0.tgz#f0e003d9ca9e7f59c7a508945d7b2ef9a04a542f"
15011501
integrity sha512-ReZxvNHIOv88FlT7rxcXIIC0fPt4KZqZbOlivyWtXLt8ESx84zd3kMC6iK5jVeS2qt+g7ftS7ye4fi06X5rtRQ==
15021502

1503+
b64@4.x.x:
1504+
version "4.1.2"
1505+
resolved "https://registry.yarnpkg.com/b64/-/b64-4.1.2.tgz#7015372ba8101f7fb18da070717a93c28c8580d8"
1506+
integrity sha512-+GUspBxlH3CJaxMUGUE1EBoWM6RKgWiYwUDal0qdf8m3ArnXNN1KzKVo5HOnE/FSq4HHyWf3TlHLsZI8PKQgrQ==
1507+
dependencies:
1508+
hoek "6.x.x"
1509+
15031510
babel-code-frame@^6.26.0:
15041511
version "6.26.0"
15051512
resolved "https://registry.yarnpkg.com/babel-code-frame/-/babel-code-frame-6.26.0.tgz#63fd43f7dc1e3bb7ce35947db8fe369a3f58c74b"
@@ -2219,12 +2226,12 @@ boilerplate-update@^0.19.0:
22192226
tmp "0.0.33"
22202227
which "^1.3.1"
22212228

2222-
boom@2.x.x:
2223-
version "2.10.1"
2224-
resolved "https://registry.yarnpkg.com/boom/-/boom-2.10.1.tgz#39c8918ceff5799f83f9492a848f625add0c766f"
2225-
integrity sha1-OciRjO/1eZ+D+UkqhI9iWt0Mdm8=
2229+
boom@7.x.x:
2230+
version "7.3.0"
2231+
resolved "https://registry.yarnpkg.com/boom/-/boom-7.3.0.tgz#733a6d956d33b0b1999da3fe6c12996950d017b9"
2232+
integrity sha512-Swpoyi2t5+GhOEGw8rEsKvTxFLIDiiKoUc2gsoV6Lyr43LHBIzch3k2MvYUs8RTROrIkVJ3Al0TkaOGjnb+B6A==
22262233
dependencies:
2227-
hoek "2.x.x"
2234+
hoek "6.x.x"
22282235

22292236
bops@0.0.3:
22302237
version "0.0.3"
@@ -2234,6 +2241,14 @@ bops@0.0.3:
22342241
base64-js "0.0.2"
22352242
to-utf8 "0.0.1"
22362243

2244+
bounce@1.x.x:
2245+
version "1.2.3"
2246+
resolved "https://registry.yarnpkg.com/bounce/-/bounce-1.2.3.tgz#2b286d36eb21d5f08fe672dd8cd37a109baad121"
2247+
integrity sha512-3G7B8CyBnip5EahCZJjnvQ1HLyArC6P5e+xcolo13BVI9ogFaDOsNMAE7FIWliHtIkYI8/nTRCvCY9tZa3Mu4g==
2248+
dependencies:
2249+
boom "7.x.x"
2250+
hoek "6.x.x"
2251+
22372252
bower-config@^1.3.0:
22382253
version "1.4.1"
22392254
resolved "https://registry.yarnpkg.com/bower-config/-/bower-config-1.4.1.tgz#85fd9df367c2b8dbbd0caa4c5f2bad40cd84c2cc"
@@ -3490,12 +3505,12 @@ cross-spawn@^6.0.0, cross-spawn@^6.0.5:
34903505
shebang-command "^1.2.0"
34913506
which "^1.2.9"
34923507

3493-
cryptiles@2.x.x:
3494-
version "2.0.5"
3495-
resolved "https://registry.yarnpkg.com/cryptiles/-/cryptiles-2.0.5.tgz#3bdfecdc608147c1c67202fa291e7dca59eaa3b8"
3496-
integrity sha1-O9/s3GCBR8HGcgL6KR59ylnqo7g=
3508+
cryptiles@4.x.x:
3509+
version "4.1.3"
3510+
resolved "https://registry.yarnpkg.com/cryptiles/-/cryptiles-4.1.3.tgz#2461d3390ea0b82c643a6ba79f0ed491b0934c25"
3511+
integrity sha512-gT9nyTMSUC1JnziQpPbxKGBbUg8VL7Zn2NB4E1cJYvuXdElHrwxrV9bmltZGDzet45zSDGyYceueke1TjynGzw==
34973512
dependencies:
3498-
boom "2.x.x"
3513+
boom "7.x.x"
34993514

35003515
crypto-random-string@^1.0.0:
35013516
version "1.0.0"
@@ -5700,15 +5715,16 @@ hash-for-dep@^1.0.2, hash-for-dep@^1.2.3:
57005715
path-root "^0.1.1"
57015716
resolve "^1.4.0"
57025717

5703-
hawk@~3.1.3:
5704-
version "3.1.3"
5705-
resolved "https://registry.yarnpkg.com/hawk/-/hawk-3.1.3.tgz#078444bd7c1640b0fe540d2c9b73d59678e8e1c4"
5706-
integrity sha1-B4REvXwWQLD+VA0sm3PVlnjo4cQ=
5718+
hawk@7, hawk@~3.1.3:
5719+
version "7.0.10"
5720+
resolved "https://registry.yarnpkg.com/hawk/-/hawk-7.0.10.tgz#960f72edac9c6b9114c8387886d7278fba9119eb"
5721+
integrity sha512-3RWF4SXN9CdZ1VDAe6Pn3Rd0tC3Lw+GV+esX5oKCrXoScZK3Ri6dl5Wt986M/hlzU+GuapTGiB0rBhGeRIBQsw==
57075722
dependencies:
5708-
boom "2.x.x"
5709-
cryptiles "2.x.x"
5710-
hoek "2.x.x"
5711-
sntp "1.x.x"
5723+
b64 "4.x.x"
5724+
boom "7.x.x"
5725+
cryptiles "4.x.x"
5726+
hoek "6.x.x"
5727+
sntp "3.x.x"
57125728

57135729
he@1.2.0:
57145730
version "1.2.0"
@@ -5743,10 +5759,10 @@ heimdalljs@^0.2.0, heimdalljs@^0.2.1, heimdalljs@^0.2.3, heimdalljs@^0.2.5, heim
57435759
dependencies:
57445760
rsvp "~3.2.1"
57455761

5746-
hoek@2.x.x:
5747-
version "2.16.3"
5748-
resolved "https://registry.yarnpkg.com/hoek/-/hoek-2.16.3.tgz#20bb7403d3cea398e91dc4710a8ff1b8274a25ed"
5749-
integrity sha1-ILt0A9POo5jpHcRxCo/xuCdKJe0=
5762+
hoek@6.x.x:
5763+
version "6.1.2"
5764+
resolved "https://registry.yarnpkg.com/hoek/-/hoek-6.1.2.tgz#99e6d070561839de74ee427b61aa476bd6bddfd6"
5765+
integrity sha512-6qhh/wahGYZHFSFw12tBbJw5fsAhhwrrG/y3Cs0YMTv2WzMnL0oLPnQJjv1QJvEfylRSOFuP+xCu+tdx0tD16Q==
57505766

57515767
home-or-tmp@^2.0.0:
57525768
version "2.0.0"
@@ -5892,9 +5908,11 @@ imurmurhash@^0.1.4:
58925908

58935909
"in-repo-a@link:tests/dummy/lib/in-repo-a":
58945910
version "0.0.0"
5911+
uid ""
58955912

58965913
"in-repo-b@link:tests/dummy/lib/in-repo-b":
58975914
version "0.0.0"
5915+
uid ""
58985916

58995917
indexof@0.0.1:
59005918
version "0.0.1"
@@ -9202,12 +9220,15 @@ snapdragon@^0.8.1:
92029220
source-map-resolve "^0.5.0"
92039221
use "^3.1.0"
92049222

9205-
sntp@1.x.x:
9206-
version "1.0.9"
9207-
resolved "https://registry.yarnpkg.com/sntp/-/sntp-1.0.9.tgz#6541184cc90aeea6c6e7b35e2659082443c66198"
9208-
integrity sha1-ZUEYTMkK7qbG57NeJlkIJEPGYZg=
9223+
sntp@3.x.x:
9224+
version "3.0.2"
9225+
resolved "https://registry.yarnpkg.com/sntp/-/sntp-3.0.2.tgz#3f0b5de6115681dce82a9478691f0e5c552de5a3"
9226+
integrity sha512-MCAPpBPFjNp1fwDVCLSRuWuH9gONtb2R+lS1esC6Mp8lP6jy60FVUtP/Qr0jBvcWAVbhzx06y1b6ptXiy32dug==
92099227
dependencies:
9210-
hoek "2.x.x"
9228+
boom "7.x.x"
9229+
bounce "1.x.x"
9230+
hoek "6.x.x"
9231+
teamwork "3.x.x"
92119232

92129233
socket.io-adapter@~1.1.0:
92139234
version "1.1.1"
@@ -9696,6 +9717,11 @@ tar@^2.0.0, tar@~2.2.1:
96969717
fstream "^1.0.2"
96979718
inherits "2"
96989719

9720+
teamwork@3.x.x:
9721+
version "3.0.3"
9722+
resolved "https://registry.yarnpkg.com/teamwork/-/teamwork-3.0.3.tgz#0c08748efe00c32c1eaf1128ef7f07ba0c7cc4ea"
9723+
integrity sha512-OCB56z+G70iA1A1OFoT+51TPzfcgN0ks75uN3yhxA+EU66WTz2BevNDK4YzMqfaL5tuAvxy4iFUn35/u8pxMaQ==
9724+
96999725
temp@0.9.0:
97009726
version "0.9.0"
97019727
resolved "https://registry.yarnpkg.com/temp/-/temp-0.9.0.tgz#61391795a11bd9738d4c4d7f55f012cb8f55edaa"

0 commit comments

Comments
 (0)