From 293d94ee20e0bc9128bf7803cbce9ea452dca3c6 Mon Sep 17 00:00:00 2001
From: snyk-bot <snyk-bot@snyk.io>
Date: Sun, 10 May 2020 03:27:08 +0300
Subject: [PATCH 1/2] fix: packages/protocol/package.json &
 packages/protocol/.snyk to reduce vulnerabilities

The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
---
 packages/protocol/package.json | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/packages/protocol/package.json b/packages/protocol/package.json
index 4ea5e760bfe..f94175afa71 100644
--- a/packages/protocol/package.json
+++ b/packages/protocol/package.json
@@ -34,7 +34,9 @@
     "weekly-faucet": "./scripts/bash/weekly_faucet.sh",
     "set-exchange-rate": "./scripts/bash/set_exchange_rate.sh",
     "network-check": "./scripts/bash/network_check.sh",
-    "test-licenses": "yarn licenses list --prod | grep '\\(─ GPL\\|─ (GPL-[1-9]\\.[0-9]\\+ OR GPL-[1-9]\\.[0-9]\\+)\\)' && echo 'Found GPL license(s). Use 'yarn licenses list --prod' to look up the offending package' || echo 'No GPL licenses found'"
+    "test-licenses": "yarn licenses list --prod | grep '\\(─ GPL\\|─ (GPL-[1-9]\\.[0-9]\\+ OR GPL-[1-9]\\.[0-9]\\+)\\)' && echo 'Found GPL license(s). Use 'yarn licenses list --prod' to look up the offending package' || echo 'No GPL licenses found'",
+    "snyk-protect": "snyk protect",
+    "prepublish": "npm run snyk-protect"
   },
   "dependencies": {
     "apollo-client": "^2.4.13",
@@ -64,7 +66,8 @@
     "twilio": "^3.23.2",
     "typechain": "git+https://github.com/celo-org/TypeChain.git#ce6a33b",
     "weak-map": "^1.0.5",
-    "web3": "1.0.0-beta.37"
+    "web3": "1.0.0-beta.37",
+    "snyk": "^1.319.2"
   },
   "devDependencies": {
     "@celo/ganache-cli": "git+https://github.com/celo-org/ganache-cli.git#2ebdf9f",
@@ -84,5 +87,6 @@
     "truffle-typings": "^1.0.6",
     "ts-node": "^7.0.1",
     "typescript": "^3.3.3"
-  }
+  },
+  "snyk": true
 }

From 8f5d5c69c1c5955513b118c720c8ee08b8bab257 Mon Sep 17 00:00:00 2001
From: snyk-bot <snyk-bot@snyk.io>
Date: Sun, 10 May 2020 03:27:09 +0300
Subject: [PATCH 2/2] fix: packages/protocol/package.json &
 packages/protocol/.snyk to reduce vulnerabilities

The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
---
 packages/protocol/.snyk | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 packages/protocol/.snyk

diff --git a/packages/protocol/.snyk b/packages/protocol/.snyk
new file mode 100644
index 00000000000..52793379f91
--- /dev/null
+++ b/packages/protocol/.snyk
@@ -0,0 +1,10 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.14.1
+ignore: {}
+# patches apply the minimum changes required to fix a vulnerability
+patch:
+  SNYK-JS-LODASH-567746:
+    - truffle-security > @truffle/contract > @truffle/debug-utils > @trufflesuite/chromafi > cheerio > lodash:
+        patched: '2020-05-10T00:27:06.121Z'
+    - truffle-security > @truffle/resolver > @truffle/contract > @truffle/debug-utils > @trufflesuite/chromafi > cheerio > lodash:
+        patched: '2020-05-10T00:27:06.121Z'