feat: updates regarding dependabot issues. node 18 workflow & engine update #229
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
this safely updates the packages which would be peer dependant. Because of `semantic-release update` to `20.1.1`, node 18 is required ncu: https://www.npmjs.com/package/npm-check-updates
due to `semantic-release` requiring node 18 all node workflows need updating too
Bumps [minimist](https://github.com/minimistjs/minimist) from 1.2.5 to 1.2.8. - [Release notes](https://github.com/minimistjs/minimist/releases) - [Changelog](https://github.com/minimistjs/minimist/blob/main/CHANGELOG.md) - [Commits](minimistjs/minimist@v1.2.5...v1.2.8) --- updated-dependencies: - dependency-name: minimist dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
EelcoLos
changed the title
…dates-and-node-18
Updated the lockfile using yarn-audit-fix --flow=patch --registry=https://registry.yarnpkg.com
amannn
reviewed
Mar 14, 2023
|
question: |
Right, that's definitely an oversight! If you don't mind, would be great if you could enable it! You can do it directly in this PR if that's easier. |
EelcoLos
force-pushed
the
package-updates-and-node-18
branch
from
164d457
to
97cc4e9
Compare
EelcoLos
changed the title
amannn
approved these changes
Mar 16, 2023
|
🎉 This PR is included in version 5.2.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes
When I forked the branch and turned on dependabot, I got the following issues(dependabot image of forked repo):
This was also mentioned in #225 I think.
closes #225 .
This PR will update packages to the latest peer dependent version, which will resolve those issues.
Demo PR
Brink-Software#20
Docs
These are the details of the dependabot warnings:
Prototype Pollution in minimist, CWE-1321
http-cache-semantics vulnerable to Regular Expression Denial of Service, CWE-1333
Prototype Pollution in JSON5 via Parse Method, CWE-1321
minimatch ReDoS vulnerability, CWE-400
Packing does not respect root-level ignore files in workspaces, CWE-200
Inefficient Regular Expression Complexity in chalk/ansi-regex, CWE-697 and CWE-1333
Exposure of Sensitive Information to an Unauthorized Actor in semantic-release, CWE-200
Regular expression denial of service in semver-regex, CWE-1333