Update modules, vulnerability error

[odykyi]

Update modules, vulnerability error when check dependencies

Xray scan found vulnerability error in handlebars lib

https://jfrog.com/integration/npm-xray/

[facebook-github-bot]

Thank you for your pull request and welcome to our community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. In order for us to review and merge your code, please sign up at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need the corporate CLA signed.

If you have received this in error or have any questions, please contact us at cla@fb.com. Thanks!

[odykyi]

@scotthovestadt review please

thanks!

[thymikee]

You'll need to update the lock file as well.

[SimenB]

And sign the CLA

[SimenB]

Note that the change in this PR will never be visible outside of this repo, so it's not really an issue at all, the published modules were fixed a couple of months ago by #7904, released in 24.3.0

[odykyi]

You'll need to update the lock file as well.

I checked

yarn.lock the same

not need to update

[chadlavi-casebook]

What's the status on this? The latest version of jest still has this vulnerability.

[SimenB]

which vulnerabilities? Again, this PR changes nothing for the published version of Jest

[chadlavi-casebook]

which vulnerabilities? Again, this PR changes nothing for the published version of Jest

I found this issue because I got an automated alert from github that handlebars 4.1.1 had a security vulnerability. When I did a yarn why handlebars (I don't use handlebars), I found that it's a dependency of jest. I'm on the latest version of jest, and still finding that the same version of handlebars is installed by it.

[SimenB]

Just upgrade it then. Easiest is probably to delete the whole handlebars entry in your lockfile, and re-run yarn. yarnpkg/yarn#4986 would have made it easier

[SimenB]

With ^ I bumped the version in the published package from Jest. That won't be get a release anytime soon though, so your better of running npm audit --fix or manually upgrade the dependency for yarn (yarnpkg/yarn#7075)

[github-actions]

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.
Please note this issue tracker is not a help forum. We recommend using StackOverflow or our discord channel for questions.