Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updates dependency versions #154

Merged
merged 1 commit into from
Dec 15, 2023
Merged

Updates dependency versions #154

merged 1 commit into from
Dec 15, 2023

Conversation

ncordon
Copy link
Collaborator

@ncordon ncordon commented Dec 14, 2023

Why

To keep the packages clean of security vulnerabilities:

# npm audit report

browserify-sign  2.6.0 - 4.2.1
Severity: high
browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack - https://github.com/advisories/GHSA-x9w5-v3q2-3rhw
fix available via `npm audit fix`
node_modules/browserify-sign

vite  4.5.0
Severity: moderate
Vite XSS vulnerability in `server.transformIndexHtml` via URL payload - https://github.com/advisories/GHSA-92r3-m2mg-pj97
fix available via `npm audit fix`
node_modules/@playwright/experimental-ct-core/node_modules/vite
node_modules/@playwright/experimental-ct-react/node_modules/vite
packages/react-codemirror-playground/node_modules/vite
packages/react-codemirror/node_modules/vite

2 vulnerabilities (1 moderate, 1 high)

@OskarDamkjaer
Copy link
Collaborator

Is this from running npm audit --fix?

@ncordon
Copy link
Collaborator Author

ncordon commented Dec 15, 2023

Is this from running npm audit --fix?

Yes!

@OskarDamkjaer OskarDamkjaer merged commit 09991fd into main Dec 15, 2023
4 checks passed
@OskarDamkjaer OskarDamkjaer deleted the updates-deps branch December 15, 2023 14:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants