-
Notifications
You must be signed in to change notification settings - Fork 12
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Security updates #51
Security updates #51
Conversation
This dependency is a false positive The nthcheck, even if required in react-scipts, is never used in the code Moreover, react-script is only a dev feature, and not needed in production mode Hence, I removed it from the dependencies and add it to devDependencies
alpine is no longer mainted nginx-alpine version used was vulnerable to latest openssl CVE This vulnerability was discovered by running Snyk scan Not tested yet
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This currently doesn't work in production mode:
> sudo docker-compose --env-file .env.production up -d --build
...
> [iscscfr-react-app 7/7] RUN npm run build:
#0 0.880
#0 0.880 > iscsc.fr-frontend@0.1.0 build
#0 0.880 > react-scripts build
#0 0.880
#0 0.889 sh: 1: react-scripts: not found
------
failed to solve: executor failed running [/bin/sh -c npm run build]: exit code: 127
This comment was marked as off-topic.
This comment was marked as off-topic.
Oh indeed let me fix this 🤔 Did you experience any issue with the SSL certificates? Or maybe you tested it on the server directly. |
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
that looks ok to me
you only changed two versions for the better 👌
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Oh indeed let me fix this thinking
EDIT: Fix 62b848b
As far as I can tell that worked, but I have 2 limitations:
- it seems I can't test SSL certificates on local see (that will answer your question)
- I get the same issue that forbade me to test production mode on V0.2.0: production and development mode #20, all I can tell is that I get the same behaviour, but I strongly advise you to test it yourself
And one request change:
please run npm install
in frontend because package-lock.json
isn't up to date, and that point makes me remember we have to deal with #31
@atxr this PR is almost ready do you have some time to finish it? |
I can try yes, but how about the tests? Should I test directly on the server? |
for SSL certificates it seems that we don't have much choice for now, we should however look for a better solution, maybe a subdomain to test automatically? we'll have to discuss that in another issue though
but you should do this first 😉 Anyway, if you're lacking time right now nevermind it's not an emergency I think (even if it seems severe the blog is quite unknown right now) |
Update package-lock.json in frontend
The tests were successful and I ran |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes exactly, as @ctmbl requested
then it's perfect 👌
This PR brings security updates about:
This changes haven't been tested yet in production mode.
Close #39 and should resolve Dependabot alerts