You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Generally, we depend on the Dependabot alerts to patch security vulnerabilities for the npm package dependencies. Also, we had reviewed the dependencies when we created this repository (~ like two years ago)
The one in the devDependencies was published 5 years ago, and maintained by 1 developer.
This ^ definitely won't be caught by it.
I wonder if we should start doing a bi-monthly security review or engage some tooling to help us with it. Any ideas are appreciated. @bamurtaugh@craiglpeters Looking for your insights 👀
For example, I noticed there're two jsonc related dependencies:
action/package.json
Line 34 in a1930bf
action/package.json
Line 46 in a1930bf
The one in the devDependencies was published 5 years ago, and maintained by 1 developer.
I know it's not been used in the source code yet, but I'm curious about how the supply chain security works there.
Thanks :)
The text was updated successfully, but these errors were encountered: