Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: updates vulnerable dependencies #923

Merged
merged 1 commit into from
Feb 16, 2024
Merged

chore: updates vulnerable dependencies #923

merged 1 commit into from
Feb 16, 2024

Conversation

rhyslbw
Copy link
Member

@rhyslbw rhyslbw commented Feb 16, 2024

Result of npm audit fix. Includes fix for GHSA-78xj-cgh5-2h22

@renanvalentin
Copy link
Contributor

does it also needs to update the package.json?

@rhyslbw
Copy link
Member Author

rhyslbw commented Feb 16, 2024

No @renanvalentin, it's an indirect dependency

@rhyslbw rhyslbw merged commit 70b00fb into main Feb 16, 2024
1 check passed
@rhyslbw rhyslbw deleted the chore/update-deps branch February 16, 2024 13:08
@pczeglik-iohk
Copy link

@renanvalentin @rhyslbw I believe we do not need to bump-up any version as this change is related to @trezor/connect-web package:

λ npm ls ip-address
nami-wallet@3.7.0 /Users/piotrczeglik/Work/PROJECTS/NAMI/nami
└─┬ @trezor/connect-web@9.1.5
  └─┬ @trezor/connect@9.1.5
    └─┬ @trezor/blockchain-link@2.1.18
      └─┬ socks-proxy-agent@6.1.1
        └─┬ socks@2.7.3
          └── ip-address@9.0.5

and we have this dependency defined as "@trezor/connect-web": "^9.0.11" (note ^), so we are good, no need to update package.json. Once package-lock.json merged it will keep this dependency version locked :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants