Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Address Snyk vulnerabilities #326

Merged
merged 2 commits into from
Nov 8, 2022
Merged

Address Snyk vulnerabilities #326

merged 2 commits into from
Nov 8, 2022

Conversation

nmanu1
Copy link
Contributor

@nmanu1 nmanu1 commented Nov 7, 2022

Update the versions of @xmldom/xmldom and loader-utils to address Snyk vulnerabilities in the packages. Remove babel-loader from the package.json because it's no longer a peer dependency for @storybook/addon-essentials (as of v6.5.0).

J=none
TEST=none

@nmanu1 nmanu1 requested a review from a team as a code owner November 7, 2022 22:06
@coveralls
Copy link

coveralls commented Nov 7, 2022

Coverage Status

Coverage remained the same at 85.428% when pulling 1a52b7d on dev/snyk into 99a9542 on develop.

@github-actions
Copy link
Contributor

github-actions bot commented Nov 7, 2022

Current unit coverage is 88.53211009174312%
Current visual coverage is 77.50533049040511%
Current combined coverage is 89.06727828746178%

Copy link
Contributor

@tatimblin tatimblin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like from the chart on this page we meet all the requirements to go to version 9 https://www.npmjs.com/package/babel-loader

@nmanu1
Copy link
Contributor Author

nmanu1 commented Nov 7, 2022

Looks like from the chart on this page we meet all the requirements to go to version 9 https://www.npmjs.com/package/babel-loader

I did some digging and the reason we had babel-loader as a dev dependency was because it was a peer dependency for one of the Storybook addons. In v6.5.0, the peer dependency was removed so we no longer need to include babel-loader in our package.json. I've removed it accordingly

Copy link
Contributor

@tatimblin tatimblin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice find

@nmanu1 nmanu1 merged commit 1896473 into develop Nov 8, 2022
@nmanu1 nmanu1 deleted the dev/snyk branch November 8, 2022 13:59
nmanu1 added a commit that referenced this pull request Nov 8, 2022
Update the versions of `@xmldom/xmldom` and `loader-utils` to address Snyk vulnerabilities in the packages. Remove `babel-loader` from the package.json because it's no longer a peer dependency for `@storybook/addon-essentials` (as of v6.5.0).

J=none
TEST=none
@nmanu1 nmanu1 mentioned this pull request Nov 8, 2022
nmanu1 added a commit that referenced this pull request Nov 8, 2022
Update the versions of `@xmldom/xmldom` and `loader-utils` to address Snyk vulnerabilities in the packages. Remove `babel-loader` from the package.json because it's no longer a peer dependency for `@storybook/addon-essentials` (as of v6.5.0).

J=none
TEST=none
nmanu1 added a commit that referenced this pull request Nov 9, 2022
### Bug Fixes
- Address security vulnerabilities in `ejs`, `async`, and `terser` (#308)
- Address security vulnerabilities in `@xmldom/xmldom` and `loader-utils` (#320, #326)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants