Re: node-yarnpkg: please update backport to fix CVE-2020-8131
On Sun, Apr 26, 2020 at 1:09 AM Xavier <yadd@debian.org> wrote:
> this requires node-gulp4 which is waiting for acceptance
> (https://ftp-master.debian.org/backports-new.html)
Great -- glad you're already on it. And I see your node-gulp update
has now reached the archive.
FWIW on my own machine I've gone and installed the fixed yarnpkg from
bullseye, and it works great. (*) But I'm sure other users using it
from buster-backports will be glad for this security update to reach
them too.
Thanks, cheers,
Greg
(*) Well, it pulled in for some reason the node-js-yaml from bullseye
at 3.13.1+dfsg-2 instead of the 3.13.1+dfsg-2~bpo10+1 in
buster-backports. I suppose that just means I didn't get the pinning
quite right; in any case the difference is harmless.
Reply to: