Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[risk=low] Upgrade karma due to dependency on vulnerable ua-parser-js #4127

Merged
merged 1 commit into from
Oct 7, 2020

Conversation

jmthibault79
Copy link
Collaborator

Description:

karma <5.2.3 depends on vulnerable versions of ua-parser-js.

https://app.snyk.io/vuln/SNYK-JS-UAPARSERJS-610226
karma-runner/karma#3564


PR checklist

  • This PR meets the Acceptance Criteria in the JIRA story
  • The JIRA story has been moved to Dev Review
  • This PR includes appropriate unit tests
  • I have run and tested this change locally
  • I have run the E2E tests on ths change against my local UI + API server with yarn test-local
  • If this includes a UI change, I have taken screen recordings or screenshots of the new behavior and notified the PO and UX designer
  • If this includes an API change, I have updated the appropriate Swagger definitions and notified API consumers
  • If this includes a new feature flag, I have created and linked new JIRA tickets to (a) turn on the feature flag and (b) remove it later

tmp "0.0.33"
ua-parser-js "0.7.21"
tmp "0.2.1"
ua-parser-js "0.7.22"
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure why Karma chooses exact versions here instead of version ranges like it does elsewhere. This would have been a much smaller change if they stuck to ranges.

@jmthibault79 jmthibault79 requested a review from calbach October 7, 2020 16:24
@jmthibault79 jmthibault79 merged commit e359e5e into master Oct 7, 2020
@jmthibault79 jmthibault79 deleted the joel/vuln branch October 7, 2020 17:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants