Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: run npm audit fix to update vulnerabile package #1388

Merged

Conversation

mstruebing
Copy link
Member

@mstruebing mstruebing commented Nov 7, 2023

We need this in order to merge dependabot updates as npm audit always returns an error.
Honestly, we need this in order to merge anything if we want to rely on a green CI state.

I needed to increase the memory limit as otherwise the tests would fail.
As it works for me locally I've opted to only set the increased limit in CI.

debian@box: /home/debian/projects/contrib/javascript git:(release-1.x)
➜   npm audit --audit-level=critical
# npm audit report

@babel/traverse  <7.23.2
Severity: critical
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code - https://github.com/advisories/GHSA-67hx-6x53-jw92
fix available via `npm audit fix`
node_modules/@babel/traverse

semver  <5.7.2 || >=6.0.0 <6.3.1
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix`
node_modules/istanbul-lib-instrument/node_modules/semver
node_modules/make-dir/node_modules/semver
node_modules/semver

2 vulnerabilities (1 moderate, 1 critical)

To address all issues, run:
  npm audit fix
debian@box: /home/debian/projects/contrib/javascript git:(release-1.x)
➜   npm audit fix

changed 1 package, and audited 340 packages in 2s

42 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities
debian@box: /home/debian/projects/contrib/javascript git:(release-1.x) ✗
➜   npm audit --audit-level=critical
found 0 vulnerabilities

@mstruebing mstruebing self-assigned this Nov 7, 2023
@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Nov 7, 2023
@mstruebing mstruebing force-pushed the run-npm-audit-fix branch 5 times, most recently from a02f221 to 113a19b Compare November 7, 2023 10:09
@brendandburns
Copy link
Contributor

Nice. Thanks!

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 7, 2023
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: brendandburns, mstruebing

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 7, 2023
@k8s-ci-robot k8s-ci-robot merged commit b7f3729 into kubernetes-client:release-1.x Nov 7, 2023
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants