WordPress.org
Get WordPress

Make WordPress Core

Opened 7 years ago

Closed 7 years ago

#48217 closed defect (bug) (fixed)

Fork and Update `grunt-replace`

Reported by: whyisjake Owned by: jorbin
Priority: normal Milestone: 5.3
Component: Build/Test Tools Version:
Severity: normal Keywords: has-patch commit
Cc: Focuses:

Description

The version of grunt replace that is bundled in core is using an outdated version of lodash that is bringing 2 low, 3 high, and 1 critical issue. This package is currently abandoned. There is a community forked version, but that is also harboring some similar security issues.

I have forked grunt-replace into grunt-replace-lts. This patch brings the new package over into core.

Related: #48203 and #48206

Attachments (1)

48217.diff​ (2.6 KB ) - added by whyisjake 7 years ago.

Download all attachments as: .zip

Change History (5)

@whyisjake
7 years ago

#1 @whyisjake
7 years ago

NPM and Github

Ideally, we should try to push this upstream. The repo hasn't been active in almost two years, including open pull requests for security updates.

#2 @whyisjake
7 years ago

  • Component General → Build/Test Tools

#3 @netweb
7 years ago

  • Keywords commit added; 2nd-opinion removed
  • Milestone Awaiting Review → 5.3

The fork and patch 48217.diff​ LGTM @whyisjake

#4 @jorbin
7 years ago

  • Owner set to jorbin
  • Resolution → fixed
  • Status assigned → closed

In 46403:

Build/Test Tools: Fork and Update grunt-replace

The version of grunt replace that is bundled in core is using an outdated version of lodash that is bringing 2 low, 3 high, and 1 critical issue. This package is currently abandoned. There is a community forked version, but that is also harboring some similar security issues.

This switches to a fork by @whyisjake and causes no change to the build.

See #48203.
Fixes #48217.
Props whyisjake, netweb for testing.

Note: See TracTickets for help on using tickets.