Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove snyk #1402

Merged
merged 2 commits into from
Dec 19, 2017
Merged

Remove snyk #1402

merged 2 commits into from
Dec 19, 2017

Conversation

lpinca
Copy link
Member

@lpinca lpinca commented Oct 14, 2017

We can't integrate Snyk to the org and manually updating the .snyk file
is not feasible. The last update dates back to August 2016. Dependencies
have been updated since then but the policy file remained the same
making it useless.

Refs: #841
Refs: #1094

@refack
Copy link
Contributor

refack commented Oct 14, 2017

We can't integrate Snyk to the org

Is that still the case even after the sensitive repos were moved out?

@lpinca
Copy link
Member Author

lpinca commented Oct 14, 2017

@refack I don't know.

We can't integrate Snyk to the org and manually updating the .snyk file
is not feasible. The last update dates back to August 2016. Dependencies
have been updated since then but the policy file remained the same
making it useless.

Refs: #841
Refs: #1094
@fhemberger
Copy link
Contributor

Updated package-lock.json with latest from master (w/o snyk deps), which unfortunately broke the diff.

I'm merging this now:

  • I still don't know what the status for 3rd party GitHub tools is in this org
  • Removing Snyk only has a very low security impact, as we just push out static HTML and don't run any actual Node.js code in production. Problems during build time would affect developer machines and build server in the same manner, so hopefully they're caught before committing.
  • If we change our mind, we can always add it back later without problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants