Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade and audit npm packages #4457

Merged
merged 3 commits into from
Dec 18, 2022
Merged

Upgrade and audit npm packages #4457

merged 3 commits into from
Dec 18, 2022

Conversation

jeremy-rifkin
Copy link
Member

This upgrades monaco-editor from 0.32.1 to 0.34.1 which I'm hoping may fix some of the monaco related errors we've been seeing in sentry and also upgrades mocha from 8.4.0 to 10.2.0, which fixes vulnerabilities npm is complaining about:

minimatch  <3.0.5
Severity: high
minimatch ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3
fix available via `npm audit fix --force`
Will install mocha@10.2.0, which is a breaking change
node_modules/mocha/node_modules/minimatch
  mocha  5.1.0 - 9.2.1
  Depends on vulnerable versions of minimatch
  Depends on vulnerable versions of nanoid
  node_modules/mocha

nanoid  3.0.0 - 3.1.30
Severity: moderate
Exposure of Sensitive Information to an Unauthorized Actor in nanoid - https://github.com/advisories/GHSA-qrpm-p2h7-hrv2
fix available via `npm audit fix --force`
Will install mocha@10.2.0, which is a breaking change
node_modules/nanoid

@jeremy-rifkin
Copy link
Member Author

Ok, not surprised things broke 😄

@jeremy-rifkin
Copy link
Member Author

This is esm/commonjs/module nonsense so we can deal with upgrading mocha later

@RubenRBS
Copy link
Member

Yeah we have had some warnings about mocha, but until we properly fix all the modules stuff, we can't upgrade from our current version. Note that this also affects some other packages

@github-actions github-actions bot added the ui label Dec 18, 2022
@jeremy-rifkin
Copy link
Member Author

I'm going to go ahead and merge, testing looks ok to me

@jeremy-rifkin jeremy-rifkin merged commit 5ee5386 into main Dec 18, 2022
@jeremy-rifkin jeremy-rifkin deleted the jr/upgrade-and-audit branch December 18, 2022 17:53
@jeremy-rifkin
Copy link
Member Author

This is now live

mattgodbolt pushed a commit that referenced this pull request Dec 20, 2022
* Upgrade and audit npm packages

* Go back to mocha 8.4.0

* Fix build, update for new api
mattgodbolt pushed a commit that referenced this pull request Jan 24, 2023
* Upgrade and audit npm packages

* Go back to mocha 8.4.0

* Fix build, update for new api
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants