Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: soc2 vulns [EXT-5919] #2459

Merged
merged 6 commits into from
Nov 6, 2024
Merged

fix: soc2 vulns [EXT-5919] #2459

merged 6 commits into from
Nov 6, 2024

Conversation

BobHemphill76
Copy link
Contributor

@BobHemphill76 BobHemphill76 commented Nov 5, 2024

Summary

Fixing security vulns found here: https://github.com/contentful/contentful-management.js/security

Description

  • BodyParser vuln via express + karma bump
  • Switch to size-limit from bundlesize
  • remove better-docs
  • bump semantic-release

Motivation and Context

Checklist (check all before merging)

  • Both unit and integration tests are passing
  • There are no breaking changes
  • Changes are reflected in the documentation

When adding a new method:

  • The new method is exported through the default and plain CMA client
  • All new public types are exported from ./lib/export-types.ts
  • Added a unit test for the new method
  • Added an integration test for the new method
  • The new method is added to the documentation

@BobHemphill76 BobHemphill76 changed the title fix: body parser vuln in express + karma [EXT-5919] fix: soc2 vulns [EXT-5919] Nov 5, 2024
@@ -62,6 +62,7 @@ jobs:
steps:
- with-workspace
- run: npm run build
- persist-workspace
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so size can use the build artifacts

@@ -94,8 +95,6 @@
"babel-plugin-inline-replace-variables": "^1.3.1",
"babel-plugin-lodash": "^3.3.4",
"babel-plugin-rewire-ts": "1.4.0",
"better-docs": "2.7.3",
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

doc generation wasn't built into our CI process and from what I can tell, this was unused with typedoc

@@ -127,9 +126,10 @@
"nyc": "^15.1.0",
"prettier": "^2.6.0",
"rimraf": "^5.0.0",
"semantic-release": "^19.0.5",
"semantic-release": "^22.0.12",
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@BobHemphill76 BobHemphill76 marked this pull request as ready for review November 5, 2024 20:02
@BobHemphill76 BobHemphill76 requested a review from a team as a code owner November 5, 2024 20:02
@BobHemphill76 BobHemphill76 merged commit 9f950e1 into master Nov 6, 2024
3 checks passed
@BobHemphill76 BobHemphill76 deleted the fix/soc2-vulns-ext-5919 branch November 6, 2024 16:13
@contentful-automation
Copy link
Contributor

🎉 This PR is included in version 11.36.1 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants