fix: @babel/preset-env vulnerabilities (v3.0.4)#670
Conversation
@babel/preset-env@7.23.2 depends on @babel/plugin-transform-modules-systemjs@7.29.0, which has vulnerabilities. The latest @babel/preset-env version fixed this
Fondryext
left a comment
Fondryext
left a comment
There was a problem hiding this comment.
Just fyi, the version bump looks good but those test failures are real, so the packages need to be remade, or maybe there really is a version conflict.
> @yext/search-ui-react@3.0.3 prepare > husky added 2 packages, and audited 1678 packages in 2s 367 packages are looking for funding run `npm fund` for details 18 vulnerabilities (5 low, 4 moderate, 9 high) To address issues that do not require attention, run: npm audit fix To address all issues possible (including breaking changes), run: npm audit fix --force Some issues need review, and may require choosing a different dependency. Run `npm audit` for details.
![semgrep-code-yext[bot]](https://avatars.githubusercontent.com/u/931250?s=60&v=4){kind=small}
| @@ -16757,13 +16788,13 @@ | |||
| "license": "MIT" | |||
| }, | |||
| "node_modules/mapbox-gl": { | |||
There was a problem hiding this comment.
Legal Risk
mapbox-gl 3.24.0 was released under the non-standard license, a license that
is currently prohibited by your organization. Merging is blocked until this is resolved.
Recommendation
Reach out to your security team or Semgrep admin to address this issue. In special cases, exceptions may be made for dependencies with violating licenses, however, the general recommendation is to avoid using a dependency under such a license.
I might be wrong, but I don't think my change caused this. The same failure occurred in the last search-ui-react PR too. |
2 participants
@babel/preset-env@7.23.2 depends on @babel/plugin-transform-modules-systemjs@7.29.0, which has vulnerabilities. The latest @babel/preset-env version fixed this