fix: patch js-yaml and nanoid CVEs - #808
Conversation
Bump the js-yaml override to 4.3.1 for GHSA-5p4m-2wfm-xmqj, the quadratic CPU consumption in omap resolution, and refresh the lock so every js-yaml copy resolves to 4.3.1. Update nanoid to 3.3.18 for GHSA-2v37-7h3g-55p8, the infinite loop with size zero. The two image-size alerts have no patched release yet, all versions up to 2.0.2 are affected. image-size only runs at build time on repository images, so there is no runtime exposure on the site. Signed-off-by: mesutoezdil <mesudozdil@gmail.com>
✅ Deploy Preview for project-hami ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Warning Review limit reached
Next review available in: 48 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: mesutoezdil The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
2 participants
What type of PR is this?
/kind bug
What this PR does / why we need it:
Resolves two of the four open Dependabot alerts:
!!omapresolution) and refreshes the lockfile so all js-yaml copies resolve to 4.3.1.The two remaining image-size alerts (GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq) have no patched release, every version up to the latest 2.0.2 is affected. image-size only runs at build time against images stored in this repository, so there is no runtime exposure; suggest dismissing those two alerts as build-time only until upstream ships a fix, matching how #706-era alerts were handled.
npm auditnow reports image-size as the only remaining finding.Which issue(s) this PR fixes:
N/A
Checklist:
npm run lintandnpm run format:checkpassnpm run buildsucceeds for bothenandzhgit commit -s)