mirror of
https://github.com/kremalicious/metamask-extension.git
synced 2024-11-25 11:28:51 +01:00
18 lines
905 B
Plaintext
18 lines
905 B
Plaintext
# improved-yarn-audit advisory exclusions
|
|
GHSA-257v-vj4p-3w2h
|
|
|
|
# yarn berry's `yarn npm audit` script reports the following vulnerability but
|
|
# it is a false positive. The offending version of 'ws' that is installed is
|
|
# 7.1.1 and is included only via remote-redux-devtools which is a devDependency
|
|
GHSA-6fc8-4gx4-v693
|
|
|
|
# yarn npm audit reports on a fast-json-patch version < 3.1.1 but due to patch
|
|
# resolution, the only version of fast-json-patch that we use is 3.1.1. We also
|
|
# have 2.2.1 installed but it is a dev only dependency. The "violation" reports
|
|
# smart-transacton-controller as the culprit but if you run
|
|
# `yarn info -A -R dependents fast-json-patch` you can see that only 2.2.1 and
|
|
# 3.3.1 are installed and that smart-transaction-controller resolves to the
|
|
# patched version of 3.3.1. We can remove this once the
|
|
# smart-transaction-controller updates its dependency.
|
|
GHSA-8gh8-hqwg-xf34
|