From a51c3f74184ba8532049da795003a9cdbcef4f2c Mon Sep 17 00:00:00 2001 From: Jarrod Ruhland Date: Fri, 10 Feb 2023 07:35:04 -0800 Subject: [PATCH] chore: upgrade jszip to ^3.10.1 No issues found with our usage in https://stuk.github.io/jszip/CHANGES.html, most notable change was 3.9.0 API change, but we are unaffected, due to not using constructor arguments. This patches the zipslip vulnerability in <= 3.7.1 and patched in >= 3.8.0. --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index ce21d2630..d48e94057 100644 --- a/package.json +++ b/package.json @@ -99,7 +99,7 @@ "archiver": "^5.0.0", "dayjs": "^1.8.34", "fast-csv": "^4.3.1", - "jszip": "^3.7.1", + "jszip": "^3.10.1", "readable-stream": "^3.6.0", "saxes": "^5.0.1", "tmp": "^0.2.0",