Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix high severity vulnerabilities. #13247

Merged
merged 2 commits into from
Feb 6, 2023
Merged

Conversation

kialam
Copy link
Member

@kialam kialam commented Nov 29, 2022

SUMMARY

Fix some Dependabot security warnings.
Cut down the number of high security vulnerabilities to 6.
Note: the one high security vulnerability for the nth-check dependency lives within a dev dependency (react-scripts) and is unlikely to pose a real threat to our builds. There is also an open PR to address the security concern on their end, it is currently under review.

ISSUE TYPE
  • Bug, Docs Fix or other nominal change
COMPONENT NAME
  • UI

@keithjgrant
Copy link
Member

keithjgrant commented Nov 29, 2022

We should probably bump these versions in package.json too

@github-actions github-actions bot added the dependencies Pull requests that update a dependency file label Nov 29, 2022
@kialam
Copy link
Member Author

kialam commented Nov 29, 2022

@keithjgrant Done. I was unable to upgrade d3 as it's already at the latest version, however the package-lock change should update the dev dep d3-color to what we need.

@AlexSCorey
Copy link
Member

@kialam just need to add some licenses for get the api-test to pass

 license file source-map.txt does not correspond to an existing requirement; it should be removed.
 license for requirement babel-helper-string-parser is missing
 license for requirement jridgewell-gen-mapping is missing
 license for requirement jridgewell-resolve-uri is missing
 license for requirement jridgewell-set-array is missing
 license for requirement jridgewell-sourcemap-codec is missing
 license for requirement jridgewell-trace-mapping is missing

@akus062381 akus062381 merged commit 32f7295 into ansible:devel Feb 6, 2023
@kialam kialam deleted the audit-fix-only branch February 6, 2023 22:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
component:ui dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants