Fixes dependency vulnerabilities #1475
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
duranb
temporarily deployed
to
test-workflow
GitHub Actions
Inactive
dandelany
temporarily deployed
to
test-workflow
GitHub Actions
Inactive
dandelany
temporarily deployed
to
test-workflow
GitHub Actions
Inactive
dandelany
temporarily deployed
to
test-workflow
GitHub Actions
Inactive
dandelany
approved these changes
Oct 1, 2024
There was a problem hiding this comment.
@duranb your changes look good to me, but I added some additional commits that need a 👍 from you as well. details:
- @duranb 's initial changes were meant to address the vulnerability warning you get when running
npm install - I added a few more commits to get the security scan part of our Publish action working again, specifically:
- upgraded Vite 5.4.6 -> 5.4.8 (didn't help but kept it)
- upgraded our
esbuilddep to^0.24.1 - forced Vite to use the same version of
esbuildfor its sub-dependency usingoverrides- this is what was causing the security scan error. In a future release they will update this on their side & we can remove the override. - Confirmed that this gets the security scan to pass
Lmk if you have any concerns... looks like Vite is upgrading shortly anyway but not released yet.
dandelany
force-pushed
the
refactor/update-deps
branch
from
0f85623 to
528aa90
Compare
dandelany
temporarily deployed
to
test-workflow
GitHub Actions
Inactive
dandelany
force-pushed
the
refactor/update-deps
branch
from
528aa90 to
d8796a5
Compare
dandelany
temporarily deployed
to
test-workflow
GitHub Actions
Inactive
duranb
force-pushed
the
refactor/update-deps
branch
from
d8796a5 to
117131c
Compare
JosephVolosin
pushed a commit
that referenced
this pull request
Oct 21, 2024
* update vite, esbuild deps, override vite to use esbuild 0.24 due to security scan --------- Co-authored-by: dandelany <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.