Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Resolve npm package vulnerabilities #2607

Open
lhw-1 opened this issue Feb 20, 2025 · 0 comments
Open

Resolve npm package vulnerabilities #2607

lhw-1 opened this issue Feb 20, 2025 · 0 comments
Labels
a-CLI a-DevOps a-Security s.UnderDiscussion The team will evaluate this issue to decide whether it is worth adding

Comments

@lhw-1
Copy link
Contributor

lhw-1 commented Feb 20, 2025

Please confirm that you have searched existing issues in the repo

Yes, I have searched the existing issues

Any related issues?

No response

What is the area that this feature belongs to?

DevOps, Security, CLI

Is your feature request related to a problem? Please describe.

Currently, there are several npm vulnerabilities being reported for MarkBind.

image

While some warnings are not directly relevant to MarkBind and can be of a lower priority, it is still better to resolve some of these before it potentially snowballs.

Describe the solution you'd like

The npm package manager advises running npm audit fix to automatically fix some of the vulnerabilities, but I am uncertain that this will allow us to resolve the issues properly (e.g. if the solutions suggested go against what we are planning, or if the solutions suggested is to directly upgrade packages we are maintaining for other reasons).

Ideally, we should go through the list and resolve the vulnerabilities individually (or even assess whether these are relevant or not). Any suggestions on better approaches welcome!

Describe alternatives you've considered

No response

Additional context

No response

@lhw-1 lhw-1 added the s.UnderDiscussion The team will evaluate this issue to decide whether it is worth adding label Feb 20, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
a-CLI a-DevOps a-Security s.UnderDiscussion The team will evaluate this issue to decide whether it is worth adding
Projects
None yet
Development

No branches or pull requests

1 participant