alibaba/Sentinel

lodash：4.17.15组件存在CVE-2020-8203漏洞建议升级

Open

#1,762 opened on Sep 25, 2020

View on GitHub
 (0 comments) (0 reactions) (0 assignees)Java (8,150 forks)batch import
area/dashboardgood first issue

Repository metrics

Stars
 (23,109 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

https://github.com/alibaba/Sentinel/blob/55a8294ab0afb08c6c048e541cf8a99c49069dac/sentinel-dashboard/src/main/webapp/resources/package-lock.json#L2418-L2421

推荐升级版本： 4.17.20

Contributor guide

Research direction
Update the lodash dependency version in the sentinel dashboard package.json and package lock.json to 4.17.20 to fix CVE 2020-8203, then create a pull request.
Tech stack
javajavascript
Domain
frontend
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
1
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Gitnpm
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
90