diff --git a/.snyk b/.snyk new file mode 100644 index 0000000..0ffa64d --- /dev/null +++ b/.snyk @@ -0,0 +1,8 @@ +# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. +version: v1.12.0 +ignore: {} +# patches apply the minimum changes required to fix a vulnerability +patch: + 'npm:lodash:20180130': + - babel > babel-core > babel-plugin-proto-to-assign > lodash: + patched: '2018-07-02T22:19:03.606Z' diff --git a/package.json b/package.json index dd2a072..2d4a74a 100644 --- a/package.json +++ b/package.json @@ -34,7 +34,9 @@ ], "scripts": { "test": "gulp test", - "build": "webpack && babel ./src/ --out-dir ./dist/es5/" + "build": "webpack && babel ./src/ --out-dir ./dist/es5/", + "snyk-protect": "snyk protect", + "prepare": "npm run snyk-protect" }, "repository": { "type": "git", @@ -42,8 +44,10 @@ }, "license": "BSD-3-Clause", "dependencies": { - "babel": "^5.8.23", - "lodash": "^3.10.1", - "sister": "^3.0.0" - } + "babel": "^6.0.0", + "lodash": "^4.17.5", + "sister": "^3.0.0", + "snyk": "^1.88.0" + }, + "snyk": true }