Skip to content

Commit b5c8783

Browse files
committed
Build: Upgrade to js-yaml 3.1.0
Use `.safeLoad()` instead of `.load()`. https://nodesecurity.io/advisories/JS-YAML_Deserialization_Code_Execution
1 parent 03e9df2 commit b5c8783

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

grunt.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ grunt.registerHelper( "read-order", function( orderFile ) {
5454
index = 0;
5555

5656
try {
57-
order = yaml.load( grunt.file.read( orderFile ) );
57+
order = yaml.safeLoad( grunt.file.read( orderFile ) );
5858
} catch( error ) {
5959
grunt.warn( "Invalid order file: " + orderFile );
6060
return null;

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,6 @@
2727
"grunt-wordpress": "1.0.7",
2828
"grunt-jquery-content": "0.11.1",
2929
"grunt-check-modules": "0.1.0",
30-
"js-yaml": "2.0.1"
30+
"js-yaml": "3.1.0"
3131
}
3232
}

0 commit comments

Comments
 (0)