Bump json-schema to version 0.2.5 and allow future patch updates #30
Conversation
mario-van-zadel
commented
Aug 6, 2020
- Bump json-schema to version 0.2.5
- Set version constraints to allow future patch updates (semantic versioning)
|
@ferranvila thank you for reviewing the pull request! There still appears the message "Review required" at the bottom of this PR. Do we have to explicitly mark this PR as "reviewed" to be able to merge it? |
| "assert-plus": "^1.0.0", | ||
| "extsprintf": "^1.3.0", | ||
| "json-schema": "^0.2.5", | ||
| "verror": "^1.10.0" |
There was a problem hiding this comment.
I think this PR is important for downstream users and I hope the maintainers can review and merge. But perhaps the versions should remain pinned rather than allowing ranges?
| "assert-plus": "^1.0.0", | |
| "extsprintf": "^1.3.0", | |
| "json-schema": "^0.2.5", | |
| "verror": "^1.10.0" | |
| "assert-plus": "1.0.0", | |
| "extsprintf": "1.3.0", | |
| "json-schema": "0.2.5", | |
| "verror": "1.10.0" |
|
There is CVE-2021-3918 by now - json-schema should be updated to newly published version 0.4.0. |
Created #32 to take that into account, incorporating also this PR. |
|
Fixed in 017f744 |