Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(deps): upgrade to security patched version of ansi-html #50

Merged
merged 2 commits into from
Apr 13, 2023

Conversation

jayjayjpg
Copy link
Contributor

@jayjayjpg jayjayjpg commented Apr 13, 2023

Fixes https://github.com/ConduitIO/mx-ui-components/security/dependabot/40

With this change, we're resolving the following dependabot alert around the insecure ansi-html package by upgrading the dependency to the latest patched security version:

Uncontrolled Resource Consumption in ansi-html - 40

Package
ansi-html
Patched version
< 0.0.8
Affected versions
0.0.8
This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.

In addition to this, the chromatic deployment workflow is fixed by using the fetch-depth: 0 configuration which is required from actions/checkout@v2 onwards:

Error: ✖ Failed to retrieve git information
✖ Found only one commit
This typically means you have ran into one of the following scenarios:
- You've checked out a shallow copy of the Git repository, which actions/checkout@v2 does by default.
  In order for Chromatic to correctly determine baseline commits, we need access to the full Git history graph.
  With actions/checkout@v2, you can enable this by setting 'fetch-depth: 0'.
  ℹ Read more at https://www.chromatic.com/docs/github-actions
- You've only made a single commit so far. 
  Please make at least one additional commit in order for Chromatic to be able to detect what's changed. 
    at /home/runner/work/_actions/chromaui/action/v1/action/main.js:[65](https://github.com/ConduitIO/mx-ui-components/actions/runs/4688177823/jobs/8308368852?pr=50#step:4:66)4:2550
    at Generator.next (<anonymous>)
    at a (/home/runner/work/_actions/chromaui/action/v1/action/main.js:654:1418)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)

Full Error Log: https://github.com/ConduitIO/mx-ui-components/actions/runs/4688177823/jobs/8308368852?pr=50

@changeset-bot
Copy link

changeset-bot bot commented Apr 13, 2023

⚠️ No Changeset found

Latest commit: cd6272b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions
Copy link
Contributor

Test coverage: 92.29%

🤷‍♂️ Did not change

1 similar comment
@github-actions
Copy link
Contributor

Test coverage: 92.29%

🤷‍♂️ Did not change

@github-actions
Copy link
Contributor

Test coverage: 92.29%

🤷‍♂️ Did not change

1 similar comment
@github-actions
Copy link
Contributor

Test coverage: 92.29%

🤷‍♂️ Did not change

@jayjayjpg jayjayjpg merged commit 1d51199 into main Apr 13, 2023
@jayjayjpg jayjayjpg deleted the jj/fix-dependabot-alert-40 branch April 13, 2023 15:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants