Skip to content

Update packages to remove security vulnerabilities - #605

Merged
mamankhan99 merged 8 commits into
masterfrom
maman/update-vulnerable-packages
Jul 26, 2022
Merged

Update packages to remove security vulnerabilities#605
mamankhan99 merged 8 commits into
masterfrom
maman/update-vulnerable-packages

Conversation

@mamankhan99

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change
minimist 1.2.5 -> 1.2.6
node-forge 1.2.1 -> 1.3.0
follow-redirects 1.14.5 -> 1.14.8
lodash 4.17.15 -> 4.17.21
node-fetch 2.6.1 -> 2.6.7
node-fetch 2.1.2 -> 2.6.1

Git issues:

chore(deps): update dependency node-forge to 1.3.0 [security]
chore(deps): update dependency minimist to 1.2.6 [security]

Pre-Merge Checklist:

Updated the version number in edx_proctoring/init.py and package.json if these changes are to be released.
Described your changes in CHANGELOG.rst
Confirmed Github reports all automated tests/checks are passing.
Approved by at least one additional reviewer.
Post-Merge:

Create a tag matching the new version number.

@openedx-webhooks

Copy link
Copy Markdown

Thanks for the pull request, @mamankhan99! I've created OSPR-6770 to keep track of it in JIRA, where we prioritize reviews. Please note that it may take us up to several weeks or months to complete a review and merge your PR.

Feel free to add as much of the following information to the ticket as you can:

  • supporting documentation
  • Open edX discussion forum threads
  • timeline information ("this must be merged by XX date", and why that is)
  • partner information ("this is a course on edx.org")
  • any other information that can help Product understand the context for the PR

All technical communication about the code itself will be done via the GitHub pull request interface. As a reminder, our process documentation is here.

Please let us know once your PR is ready for our review and all tests are green.

⚠️ We can't start reviewing your pull request until you've submitted a signed contributor agreement or indicated your institutional affiliation. Please see the CONTRIBUTING file for more information. If you've signed an agreement in the past, you may need to re-sign. See The New Home of the Open edX Codebase for details.

@natabene

natabene commented Jun 8, 2022

Copy link
Copy Markdown

@mamankhan99 Thank you for your contribution. Once your forms have been processed, we will be able to review.

@mamankhan99 mamankhan99 reopened this Jun 13, 2022
@mamankhan99 mamankhan99 self-assigned this Jun 13, 2022
@mamankhan99 mamankhan99 added the blocked by other work PR cannot be finished until other work is complete label Jun 13, 2022
@mamankhan99

Copy link
Copy Markdown
Contributor Author

Blocked till #607 got merged.

@natabene

Copy link
Copy Markdown

@mamankhan99 Your CLA check got green, so owning team can review and merge any time they find fit.

@jmbowman
jmbowman requested a review from a team June 14, 2022 02:50
@davidjoy

Copy link
Copy Markdown
Contributor

Looks good, seems like it has some failing tests though. Probably need to save some snapshots, I'd guess?

@jmbowman jmbowman added waiting on author PR author needs to resolve review requests, answer questions, fix tests, etc. and removed community manager review open-source-contribution PR author is not from Axim or 2U labels Jul 25, 2022
@mamankhan99 mamankhan99 removed the blocked by other work PR cannot be finished until other work is complete label Jul 26, 2022
@codecov

codecov Bot commented Jul 26, 2022

Copy link
Copy Markdown

Codecov Report

Merging #605 (76d088a) into master (5c5dbc3) will increase coverage by 0.05%.
The diff coverage is 85.71%.

@@            Coverage Diff             @@
##           master     #605      +/-   ##
==========================================
+ Coverage   39.53%   39.58%   +0.05%     
==========================================
  Files         106      106              
  Lines        2188     2190       +2     
  Branches      582      586       +4     
==========================================
+ Hits          865      867       +2     
  Misses       1238     1238              
  Partials       85       85              
Impacted Files Coverage Δ
src/account-settings/demographics/Checkboxes.jsx 13.63% <ø> (ø)
src/id-verification/ImageFileUpload.jsx 36.36% <ø> (ø)
src/id-verification/panels/BasePanel.jsx 90.90% <ø> (ø)
src/id-verification/panels/GetNameIdPanel.jsx 72.72% <ø> (ø)
...s/certificate-preference/CertificatePreference.jsx 88.37% <81.81%> (+0.56%) ⬆️
src/account-settings/name-change/NameChange.jsx 88.46% <100.00%> (ø)
src/id-verification/panels/SummaryPanel.jsx 96.00% <100.00%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 5c5dbc3...76d088a. Read the comment docs.

@mamankhan99
mamankhan99 merged commit 0527c73 into master Jul 26, 2022
@mamankhan99
mamankhan99 deleted the maman/update-vulnerable-packages branch July 26, 2022 08:05
@jmbowman jmbowman removed the waiting on author PR author needs to resolve review requests, answer questions, fix tests, etc. label Jul 27, 2022
ghassanmas pushed a commit to ghassanmas/frontend-app-account that referenced this pull request Oct 12, 2022
* fix: updated vulnerable packages

* fix: fixed failed tests after package update

* fix: linting issues failing ci tests

* fix: package lock update

* fix: snapshot updated to UTC

* fix: missing dependency 'long'
ghassanmas pushed a commit to ghassanmas/frontend-app-account that referenced this pull request Oct 12, 2022
Update packages to remove security vulnerabilities (openedx#605)

* fix: updated vulnerable packages

* fix: fixed failed tests after package update

* fix: linting issues failing ci tests

* fix: package lock update

* fix: snapshot updated to UTC

* fix: missing dependency 'long'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

5 participants