Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revert "Removed lerna from build_scripts" #18229

Closed

Conversation

altendky
Copy link
Contributor

Reverts #18180

Copy link

socket-security bot commented Jun 21, 2024

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/lerna@8.1.3 Transitive: environment, eval, filesystem, network, shell, unsafe +582 213 MB
npm/nx@19.0.1 environment, filesystem, network, shell, unsafe Transitive: eval +132 95.6 MB nrwl-jason

View full report↗︎

Copy link

socket-security bot commented Jun 21, 2024

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package NoteSourceCI
Install scripts npm/nx@19.0.1
  • Install script: postinstall
  • Source: node ./bin/post-install
🚫
Install scripts npm/nx@19.0.3
  • Install script: postinstall
  • Source: node ./bin/post-install
🚫

View full report↗︎

Next steps

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore npm/nx@19.0.1
  • @SocketSecurity ignore npm/nx@19.0.3

@altendky altendky added Changed Required label for PR that categorizes merge commit message as "Changed" for changelog CI CI changes labels Jun 21, 2024
@cmmarslender cmmarslender reopened this Jun 22, 2024
Copy link

coveralls-official bot commented Jun 22, 2024

Pull Request Test Coverage Report for Build 9622250971

Details

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • 20 unchanged lines in 7 files lost coverage.
  • Overall coverage increased (+0.02%) to 90.898%

Files with Coverage Reduction New Missed Lines %
chia/data_layer/data_store.py 1 94.37%
chia/server/server.py 1 81.46%
chia/daemon/server.py 1 83.22%
chia/data_layer/data_layer_wallet.py 2 91.93%
chia/rpc/rpc_server.py 3 87.71%
chia/introducer/introducer_api.py 5 78.26%
chia/full_node/full_node.py 7 85.91%
Totals Coverage Status
Change from base Build 9619484401: 0.02%
Covered Lines: 100236
Relevant Lines: 110214

💛 - Coveralls

@altendky
Copy link
Contributor Author

closing in favor of #18232

@altendky altendky closed this Jun 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Changed Required label for PR that categorizes merge commit message as "Changed" for changelog CI CI changes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants