-
Notifications
You must be signed in to change notification settings - Fork 22
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix vulnerability #75
Conversation
Hmm, we've been using yarn to manage things on the Patternlab side. Without a new |
@rbayliss yes please! feel free to take over! |
This actually isn't possible to fix at the moment - we're waiting on an upstream update in nodejs/node-gyp#1471. Once that's done, we can run |
@rbayliss do you want me to review this PR? So we are removing the package-lock.json in patternlab and updating the package.json/package.lock in react. Do we need to monitor for an upstream update in nodejs/node-gyp#1471 somewhere (maybe in the |
@mrossi113 - Let's leave it for now. It's still in progress, since we haven't updated all of the vulnerable packages yet. |
The |
@mrjmd - is it enough of an issue that we should merge what's been done so far and follow up to get the other vulnerability later on? |
I just checked back in on this, and the On a side note, babelify needs an update on the Patternlab side. This turns out to be complicated, since babel's made a lot of progress since Mayflower got started. I'm gonna create a separate ticket just for that. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@clairesunstudio - This looks good to me. I'm assuming we can go ahead and merge it now? See my comments above - the hoek
vulnerability still isn't fixed upstream, but I don't think we should wait on it any longer.
auto fix npm vulnerabilities
To test: run
npm audit
before [patternlab]
after [patternlab]
before [react]
after [react]