Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix vulnerabilities found by pnpm audit #182

Merged
merged 6 commits into from
Sep 7, 2023
Merged

Conversation

cubeddu
Copy link
Contributor

@cubeddu cubeddu commented Aug 29, 2023

Description of changes:
Fix vulnerabilities found by pnpm audit.

This PR fixes the following vulnerabilities found by pnpm audit:

  • Cross-realm object access in Webpack 5 (high severity)
  • Command Injection in lodash (high severity)
  • Regular Expression Denial of Service (ReDoS) in lodash (moderate severity)

We updated the affected packages to their latest patched versions to address the vulnerabilities. Specifically, we updated the webpack package to version 5.76.0, the lodash package to version 4.17.21, and the terser-webpack-plugin package to version 5.3.6.

No breaking changes were introduced by these updates.

Note that we used pnpm to perform the audit and update the packages, as it is the package manager used in this project.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@codecov
Copy link

codecov bot commented Sep 1, 2023

Codecov Report

Patch coverage has no change and project coverage change: +0.24% 🎉

Comparison is base (29dbd6b) 9.43% compared to head (3a677de) 9.67%.

Additional details and impacted files
@@           Coverage Diff            @@
##            main    #182      +/-   ##
========================================
+ Coverage   9.43%   9.67%   +0.24%     
========================================
  Files        463     406      -57     
  Lines      30853   30086     -767     
  Branches     246     246              
========================================
  Hits        2911    2911              
+ Misses     27935   27168     -767     
  Partials       7       7              

see 101 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@cubeddu
Copy link
Contributor Author

cubeddu commented Sep 6, 2023

Test was added and then removed to keep the scope of the PR related to the audit.
another PR will be open with the test removed from this PR to Keep improving the platform.

@michaelnchin michaelnchin merged commit 8be3ce6 into aws:main Sep 7, 2023
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
No open projects
Status: ✅ Done
Development

Successfully merging this pull request may close these issues.

3 participants