[GHSA-4xc9-xhrj-v574] Prototype Pollution in lodash #5980
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR updates a GitHub Security Advisory (GHSA-4xc9-xhrj-v574) for a prototype pollution vulnerability in lodash by adding lodash-rails to the list of affected packages.
- Adds
lodash-railsRubyGems package to the affected products list - Updates the modification timestamp to reflect the change
| "introduced": "0" | ||
| }, | ||
| { | ||
| "fixed": "4.17.11" |
There was a problem hiding this comment.
The fixed version "4.17.11" appears to be a lodash (JavaScript) version number, but this entry is for the "lodash-rails" RubyGems package which likely has different versioning. Please verify the correct fixed version for the lodash-rails gem.
Copilot uses AI. Check for mistakes.
There was a problem hiding this comment.
It is the correct version - the gems versioning matches the version of lodash that it provides (at least in the 4.x line)
7b8bdc9
into
G-Rath/advisory-improvement-5980
|
Hi @G-Rath! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
Updates
Comments
Added
lodash-railsto list of impacted packages