Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update frontend dependencies for 2023.4 #852

Merged
merged 2 commits into from
Sep 14, 2023
Merged

Conversation

ktuite
Copy link
Member

@ktuite ktuite commented Sep 5, 2023

Closes #824

> npm audit

# npm audit report

semver  <=5.7.1 || 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix`
node_modules/@vue/cli-shared-utils/node_modules/semver
node_modules/cross-spawn/node_modules/semver
node_modules/css-loader/node_modules/semver
node_modules/normalize-package-data/node_modules/semver
node_modules/postcss-loader/node_modules/semver
node_modules/semver
node_modules/vue-eslint-parser/node_modules/semver

word-wrap  <1.2.4
Severity: moderate
word-wrap vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-j8xg-fqg3-53r7
fix available via `npm audit fix`
node_modules/word-wrap

2 moderate severity vulnerabilities

What has been done to verify that this works as intended?

Tests still pass.

Why is this the best possible solution? Were any other approaches considered?

I think this is just a small change to a regular expression parsing library.

How does this change affect users? Describe intentional changes to behavior and behavior that could have accidentally been affected by code changes. In other words, what are the regression risks?

I don't think it has any effect.

Does this change require updates to user documentation? If so, please file an issue here and include the link below.

Before submitting this PR, please make sure you have:

  • run npm run test and npm run lint and confirmed all checks still pass OR confirm CircleCI build passes
  • verified that any code or assets from external sources are properly credited in comments or that everything is internally sourced

@ktuite ktuite requested a review from sadiqkhoja September 5, 2023 23:59
@ktuite ktuite force-pushed the ktuite/2023.4_update_deps branch from fe10016 to ad5c06b Compare September 12, 2023 00:07
@ktuite ktuite changed the title updated dependencies Update frontend dependencies for 2023.4 Sep 12, 2023
@ktuite ktuite merged commit fd2bdcb into master Sep 14, 2023
@ktuite ktuite deleted the ktuite/2023.4_update_deps branch September 14, 2023 16:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Update dependencies for v2023.4
2 participants