Update vulnerable libraries #766
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Can't update the live-server dependency
rorymckinley
force-pushed
the
763-update-decode-uri-component
branch
from
a14e8c3 to
a2b8c38
Compare
rorymckinley
commented
Sep 6, 2024
| '@openfn/cli': patch | ||
| --- | ||
|
|
||
| Upgrade vulnerable version of ws. |
There was a problem hiding this comment.
@josephjclark This is an alarming comment - to serve as a friendly reminder that I bumped ws several minor versions and, as a result, you thought that some additional testing may be prudent.
josephjclark
changed the title
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Short Description
Upgrades a number of vulnerable libraries.
Related issue
#763
fixes https://github.com/OpenFn/kit/security/dependabot/22
fixes https://github.com/OpenFn/kit/security/dependabot/21
fixes https://github.com/OpenFn/kit/security/dependabot/16
fixes https://github.com/OpenFn/kit/security/dependabot/12
fixes https://github.com/OpenFn/kit/security/dependabot/10
fixes https://github.com/OpenFn/kit/security/dependabot/8
Implementation Details
Some vulnerable libraries remain, but they appear to entirely be dependencies of other OpenFN libraries, so will tackle those first.
QA Notes
List any considerations/cases/advice for testing/QA here.
Checklist before requesting a review
Release branch checklist
Still not sure of the criteria for a release PR :).
If this IS a release branch:
pnpm changeset versionfrom root to bump versionspnpm installpnpm changeset tagto generate tagsgit push --tagsTags may need updating if commits come in after the tags are first generated.