Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build(deps): Bump archive (and other deps) #456

Merged
merged 1 commit into from Sep 12, 2023

Conversation

cpswan
Copy link
Member

@cpswan cpswan commented Sep 12, 2023

Archive <= 3.3.7 has filename spoofing and path traversal vulnerabilities causing Security alerts.

- What I did

Bumped dependencies in pubspec.lock

- How I did it

cd packages/sshnp_gui
dart pub update

- How to verify it

Security alerts should be cleared.

- Description for the changelog

build(deps): Bump archive (and other deps)

@CurtlyCritchlow
Copy link
Contributor

@XavierChanth Should this PR be merged into trunk or into the sshnp_gui branch? @cpswan We're using the ssnp_gui branch as the main branch for the GUI for now.

@cpswan
Copy link
Member Author

cpswan commented Sep 12, 2023

@CurtlyCritchlow the security alerts don't care about our feature branches, they're just looking at the default branch (trunk).

We can debate the wisdom of long lived feature branches another time. But getting this PR merged will at least clear the alerts.

At some stage that feature branch should be merged with trunk, and at that stage I'd hope that we're not going backwards to vulnerable deps :/

@cpswan cpswan merged commit 9356a36 into trunk Sep 12, 2023
12 checks passed
@cpswan cpswan deleted the cpswan-bump-gui-pubspec_lock branch September 12, 2023 13:49
@XavierChanth
Copy link
Member

At some stage that feature branch should be merged with trunk, and at that stage I'd hope that we're not going backwards to vulnerable deps :/

I'm keeping the gui branch up to date with trunk

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants