Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

change: [M3-8383] - Packages updates and resolution for braces vulnerability #10830

Merged
merged 3 commits into from
Aug 26, 2024

Conversation

abailly-akamai
Copy link
Contributor

@abailly-akamai abailly-akamai commented Aug 24, 2024

Description 📝

Updating packages to resolve this braces vulnerability.

See self review for extra details about the version bumps.

Changes 🔄

  • Updating various packages and add braces resolution

How to test 🧪

Verification steps

  • run unit tests
  • run cloud manager and check terminal/console

As an Author I have considered 🤔

Check all that apply

  • 👀 Doing a self review
  • ❔ Our contribution guidelines
  • 🤏 Splitting feature into small PRs
  • ➕ Adding a changeset
  • 🧪 Providing/Improving test coverage
  • 🔐 Removing all sensitive information from the code and PR description
  • 🚩 Using a feature flag to protect the release
  • 👣 Providing comprehensive reproduction steps
  • 📑 Providing or updating our documentation
  • 🕛 Scheduling a pair reviewing session
  • 📱 Providing mobile support
  • ♿ Providing accessibility support

@abailly-akamai abailly-akamai self-assigned this Aug 24, 2024
@@ -47,6 +47,7 @@
"docs": "bunx vitepress@1.0.0-rc.44 dev docs"
},
"resolutions": {
"braces": "^3.0.3",
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the resolution is needed because cypress-vite (latest) still requires a version of chokidar that itself still requires braces 3.0.2. I don't think there's a better way to do it for now.

@@ -50,7 +50,7 @@
"eslint-plugin-sonarjs": "^0.5.0",
"lint-staged": "^13.2.2",
"prettier": "~2.2.1",
"tsup": "^7.2.0"
"tsup": "^8.2.4"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tsup and lint-staged are bumped to consolidate other dependencies around this update and avoid more resolution declarations. No regression noticed.

@abailly-akamai abailly-akamai marked this pull request as ready for review August 24, 2024 03:15
@abailly-akamai abailly-akamai requested a review from a team as a code owner August 24, 2024 03:15
@abailly-akamai abailly-akamai requested review from jdamore-linode and jaalah-akamai and removed request for a team August 24, 2024 03:15
Copy link

github-actions bot commented Aug 24, 2024

Coverage Report:
Base Coverage: 82.62%
Current Coverage: 82.62%

@bnussman-akamai bnussman-akamai added the Dependencies Pull requests that update a dependency file label Aug 26, 2024
Copy link
Contributor

@bnussman-akamai bnussman-akamai left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📦🚀

Copy link
Contributor

@jdamore-linode jdamore-linode left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @abailly-akamai!

@abailly-akamai abailly-akamai merged commit ff631ef into linode:develop Aug 26, 2024
18 of 19 checks passed
@abailly-akamai
Copy link
Contributor Author

fixed! https://github.com/linode/manager/security/dependabot/102

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants