Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(security): fix 4 vulnerabilities #27882

Conversation

aaronleopold
Copy link

@aaronleopold aaronleopold commented Sep 22, 2023

Additional details

Running yarn audit shows a lot of vulnerabilities. I am currently in the process of trying to trim some of these down in order to satisfy some of the security requirements at my company, and managed to remove 1 critical and 3 high sev vulnerabilities using resolutions. I did try and tackle more, however there were a LOT of breaking changes for a decent amount of them. I tried to find the guidelines for making these kinds of security-focused, dependency upgrades, but didn't find anything specific, so I apologize if I've missed a step or guideline somewhere!

Steps to test

Installation and testing seemed unchanged with these resolutions, and while I am not yet familiar enough with the entire build process for Cypress, I imagine there is not much to test aside from ensuring no incompatibilities have been added that the tests did not otherwise miss.

How has the user experience changed?

Realistically, it shouldn't change UX!

PR Tasks

@CLAassistant
Copy link

CLAassistant commented Sep 22, 2023

CLA assistant check
All committers have signed the CLA.

@cypress-app-bot
Copy link
Collaborator

@aaronleopold aaronleopold force-pushed the al/fix-some-vulnerabilities branch from a047ac3 to 0b8f3d7 Compare September 22, 2023 15:24
@aaronleopold aaronleopold force-pushed the al/fix-some-vulnerabilities branch from 0b8f3d7 to abb7389 Compare September 22, 2023 15:31
@aaronleopold aaronleopold marked this pull request as ready for review September 22, 2023 15:31
@jennifer-shehane
Copy link
Member

@aaronleopold We have continuous scans of our repos for security vulnerabilities that we address continuously. Can you outline the dependencies that were showing up as critical/high that you were looking to address? As this PR stands, it is adding new dependencies, not updating existing ones so doesn't appear to be addressing any specific security vulnerabilities.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants