Upgrading gh-pages 4 to 5
Breaking4.0.0 → 5.0.0Breaking1Security1Platform1Changed2Other5
SecurityCritical · CVSS 9.8tschaub gh-pages vulnerable to prototype pollutionGHSA-8mmm-9v2q-x3f9 · CVE-2022-37611 ↗
BreakingUpgrade verdict
1 breaking change and a platform requirement change and a security fix.
In plain terms
- If you call publish, you can now always rely on getting a promise back, even when something goes wrong.
- The package itself still works on Node 12, but its automated tests now need Node 14. Node 12 support may be removed in a future major version.
- tschaub gh-pages vulnerable to prototype pollution
Must act 3 items need code or config changes
Installs 41 packages in all (was 42).
No longer installs lodash.
Moves async 2.6.4 → 3.2.6, email-addresses 3.1.0 → 5.0.0. Your build may pick other versions.
What you must change
Breaking1
The publish method now always returns a promise, including in error cases where it previously did not.
publishSecurity1
tschaub gh-pages vulnerable to prototype pollution
Critical · CVSS 9.8Platform1
Development dependencies require Node 14 for tests; the library should still work on Node 12, but tests no longer run in CI for version 12.