[PR] CVE-2024-21538 set resolutions for cross-spawn [incubator-kie-tools]

["jstastny-cz (via GitHub)" <gi...@apache.org>]

jstastny-cz opened a new pull request, #3088:
URL: https://github.com/apache/incubator-kie-tools/pull/3088

   cross-spawn vulnerability CVE-2024-21538 gets into our project through direct dependency cross-env. Cross-env unfortunately does not have more recent release that would use unaffected version of cross-spawn, it is in maintenance mode and considering the release history, no fix is on the way.
   
   Resorted to resolutions entry to force cross-spawn ^7.0.6 (which is most recent).


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org

Re: [PR] CVE-2024-21538 set resolutions for cross-spawn [incubator-kie-tools]

["tiagobento (via GitHub)" <gi...@apache.org>]

tiagobento merged PR #3088:
URL: https://github.com/apache/incubator-kie-tools/pull/3088


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org