membphis commented on PR #14020: URL: https://github.com/apache/apisix/pull/14020#issuecomment-6758202544
Non-blocking dependency note: the simple-git v4 named-import migration in this PR is correct. However, the lockfile brings in `@simple-git/[email protected]`; simple-git 4.0.2 updates it to 2.0.1 to fix GHSA-v5rq-49vh-5v5c, a `VISUAL` editor guard bypass. The current APISIX usage is a non-interactive clone and does not appear to meet the published exploit preconditions, so this does not need to block an urgent merge. When convenient, please consider updating simple-git to 4.0.2 or later and regenerating the lockfile. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
