fix audit #4014
fix audit #4014
Conversation
|
Backports to the stable branch are to be avoided unless absolutely necessary for fixing bugs, security issues, and perf regressions. Changes intended for backport should be structured such that a minimum effective diff can be committed separately from any refactoring, plumbing, cleanup, etc that are not strictly necessary to achieve the goal. Any of the latter should go only into master and ride the normal stabilization schedule. |
|
Backports to the beta branch are to be avoided unless absolutely necessary for fixing bugs, security issues, and perf regressions. Changes intended for backport should be structured such that a minimum effective diff can be committed separately from any refactoring, plumbing, cleanup, etc that are not strictly necessary to achieve the goal. Any of the latter should go only into master and ride the normal stabilization schedule. Exceptions include CI/metrics changes, CLI improvements and documentation updates on a case by case basis. |
#### Problem Audit is failing due to an issue on idna. #### Summary of changes Since the dependency is pretty buried, do the same thing as anza-xyz/agave#4014 and ignore it.
#### Problem Audit is failing due to an issue on idna. #### Summary of changes Since the dependency is pretty buried, do the same thing as anza-xyz/agave#4014 and ignore it.
|
CI is broken due to this. Can we approve/merge this PR? |
(cherry picked from commit 6c86ce5) # Conflicts: # ci/do-audit.sh
(cherry picked from commit 6c86ce5)
(cherry picked from commit 6c86ce5) # Conflicts: # ci/do-audit.sh
(cherry picked from commit 6c86ce5)
(cherry picked from commit 6c86ce5) # Conflicts: # ci/do-audit.sh
Problem
the audit failed. we need to upgrade idna to >= 1.0.0. however, the dep chain looks like:
and jsonrpc-core-client has not released any new version in the past 3y ...
Summary of Changes
ignore it as a stopgap