Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): refresh start-server-and-test #815

Merged

Conversation

MikeMcC399
Copy link
Collaborator

Issue

npm audit shows a vulnerability from follow-redirects@1.15.5

follow-redirects  <=1.15.5
Severity: moderate
follow-redirects' Proxy-Authorization header kept across hosts - https://github.com/advisories/GHSA-cxjh-pqwp-8mfp
fix available via `npm audit fix`
node_modules/follow-redirects

follow-redirects is a dependency of start-server-and-test

└─┬ start-server-and-test@2.0.3
  └─┬ wait-on@7.2.0
    └─┬ axios@1.6.7
      └── follow-redirects@1.15.5

Change

start-server-and-test@2.0.3 is uninstalled and reinstalled with npm.

npm uninstall start-server-and-test
npm install start-server-and-test -D -E

This refreshes dependencies axios and follow-redirects, remediating the moderate vulnerability from follow-redirects@1.15.5 by updating to follow-redirects@1.15.6. (It leaves the dependencies in a robuster state than if npm audit fix were to be executed which would only update follow-redirects, not axios.)

npm ls follow-redirects after change shows:

└─┬ start-server-and-test@2.0.3
  └─┬ wait-on@7.2.0
    └─┬ axios@1.6.8
      └── follow-redirects@1.15.6

Verification

Execute npm audit and check that there is no mention of follow-directs.

@cypress-app-bot
Copy link
Collaborator

@MikeMcC399 MikeMcC399 marked this pull request as ready for review March 27, 2024 14:50
@jennifer-shehane jennifer-shehane merged commit 4d6fa1c into cypress-io:master Mar 28, 2024
10 checks passed
@MikeMcC399 MikeMcC399 deleted the refresh/start-server-and-test branch March 28, 2024 19:31
@cypress-app-bot
Copy link
Collaborator

🎉 This PR is included in version 2.0.5 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants