Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

build(deps): bulk fix CVEs via dependency resolution overrides 2023-10-23 #2828

Closed
petermetz opened this issue Oct 24, 2023 · 0 comments · Fixed by #2830
Closed

build(deps): bulk fix CVEs via dependency resolution overrides 2023-10-23 #2828

petermetz opened this issue Oct 24, 2023 · 0 comments · Fixed by #2830
Assignees
@petermetz
Labels
dependencies Pull requests that update a dependency file P1 Priority 1: Highest Security Related to existing or potential security vulnerabilities
Milestone
v2.0.0

Comments

@petermetz
Copy link
Member

Description

Upgrading vulnerable dependencies have become a game of whack-a-mole: Vulnerabilities that I've submitted pull requests for in the past few weeks are reappearing because new pull requests keep adding back the vulnerable versions of these dependencies to the project build.
We could have a CI step scanning for these and block the PR's from getting merged but that's extra resources used on the already stretched-thin CI so the simpler route is to start using the central (root package.json file's) resolution overrides more aggressively. Previously I was advocating for this to be a last resort, but seeing in recent weeks how the accidental re-adding of vulnerabilities happen very frequently nowadays (due to project growth which is a good thing in itself) I changed my mind on it and decided that my new recommendation is to lock ourselves away from vulnerable versions of dependencies entirely via the centralized overrides.

The scope of this task: Submit one PR with resolution overrides.

Acceptance Criteria

  1. All the resolution overrides are defined with a "great or equal" qualifier to ensure that we are not blocking people from upgrading further (e.g., if v0.9.0 is vulnerable, we should say >=1.0.0 instead of =1.0.0 because the former is not forcing us to not use v1.1.0 in the future as it comes out)
  2. Each resolution override is detailed in the commit message body, links to the github security advisory and the CVE IDs are included
  3. Build is still working
  4. There is no significant slowdown in the build
  5. The tests are passing as well
@petermetz petermetz added dependencies Pull requests that update a dependency file Security Related to existing or potential security vulnerabilities P1 Priority 1: Highest labels Oct 24, 2023
@petermetz petermetz added this to the v2.0.0 milestone Oct 24, 2023
@petermetz petermetz self-assigned this Oct 24, 2023
petermetz added a commit to petermetz/cacti that referenced this issue Oct 24, 2023
@petermetz
build(deps): bulk fix CVEs via dependency resolution overrides 2023-1…
6abf5c0 
…0-23

WORK IN PROGRESS

Fixes hyperledger#2828

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
petermetz added a commit to petermetz/cacti that referenced this issue Oct 24, 2023
@petermetz
build(deps): bulk fix CVEs via dependency resolution overrides 2023-1…
ef70da8 
…0-23

1. Couldn't get rid of vulnerable versions in a couple of dependencies
because the underlying dependencies have gone ESM only which is a blocker
for us at the moment unfortunately.
2. Swapped out the ubiquity TS client to a version of it that I self
published onto npm after a full renovation of all of its dependencies.

Depends on hyperledger#2807 (because that one also has a couple of dependency bumps
that are needed to eliminate the vulnerabilities)

Fixes hyperledger#2828

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
@petermetz petermetz mentioned this issue Oct 24, 2023
Merged
5 tasks
petermetz added a commit to petermetz/cacti that referenced this issue Nov 1, 2023
@petermetz
build(deps): bulk fix CVEs via dependency resolution overrides 2023-1…
b1bee26 
…0-23

1. Couldn't get rid of vulnerable versions in a couple of dependencies
because the underlying dependencies have gone ESM only which is a blocker
for us at the moment unfortunately.
2. Swapped out the ubiquity TS client to a version of it that I self
published onto npm after a full renovation of all of its dependencies.

Depends on hyperledger#2807 (because that one also has a couple of dependency bumps
that are needed to eliminate the vulnerabilities)

Fixes hyperledger#2828

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
petermetz added a commit to petermetz/cacti that referenced this issue Nov 7, 2023
@petermetz
build(deps): bulk fix CVEs via dependency resolution overrides 2023-1…
63d61d2 
…0-23

1. Couldn't get rid of vulnerable versions in a couple of dependencies
because the underlying dependencies have gone ESM only which is a blocker
for us at the moment unfortunately.
2. Swapped out the ubiquity TS client to a version of it that I self
published onto npm after a full renovation of all of its dependencies.

Depends on hyperledger#2807 (because that one also has a couple of dependency bumps
that are needed to eliminate the vulnerabilities)

Fixes hyperledger#2828

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
petermetz added a commit to petermetz/cacti that referenced this issue Nov 10, 2023
@petermetz
build(deps): bulk fix CVEs via dependency resolution overrides 2023-1…
277798e 
…0-23

1. Couldn't get rid of vulnerable versions in a couple of dependencies
because the underlying dependencies have gone ESM only which is a blocker
for us at the moment unfortunately.
2. Swapped out the ubiquity TS client to a version of it that I self
published onto npm after a full renovation of all of its dependencies.

Depends on hyperledger#2807 (because that one also has a couple of dependency bumps
that are needed to eliminate the vulnerabilities)

Fixes hyperledger#2828

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
petermetz added a commit to petermetz/cacti that referenced this issue Nov 10, 2023
@petermetz
build(deps): bulk fix CVEs via dependency resolution overrides 2023-1…
27334af 
…0-23

1. Couldn't get rid of vulnerable versions in a couple of dependencies
because the underlying dependencies have gone ESM only which is a blocker
for us at the moment unfortunately.
2. Swapped out the ubiquity TS client to a version of it that I self
published onto npm after a full renovation of all of its dependencies.

Depends on hyperledger#2807 (because that one also has a couple of dependency bumps
that are needed to eliminate the vulnerabilities)

Fixes hyperledger#2828

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
petermetz added a commit to petermetz/cacti that referenced this issue Nov 10, 2023
@petermetz
build(deps): bulk fix CVEs via dependency resolution overrides 2023-1…
c75ecf4 
…0-23

1. Couldn't get rid of vulnerable versions in a couple of dependencies
because the underlying dependencies have gone ESM only which is a blocker
for us at the moment unfortunately.
2. Swapped out the ubiquity TS client to a version of it that I self
published onto npm after a full renovation of all of its dependencies.

Depends on hyperledger#2807 (because that one also has a couple of dependency bumps
that are needed to eliminate the vulnerabilities)

Fixes hyperledger#2828

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
petermetz added a commit to petermetz/cacti that referenced this issue Nov 14, 2023
@petermetz
build(deps): bulk fix CVEs via dependency resolution overrides 2023-1…
1419661 
…0-23

1. Couldn't get rid of vulnerable versions in a couple of dependencies
because the underlying dependencies have gone ESM only which is a blocker
for us at the moment unfortunately.
2. Swapped out the ubiquity TS client to a version of it that I self
published onto npm after a full renovation of all of its dependencies.

Depends on hyperledger#2807 (because that one also has a couple of dependency bumps
that are needed to eliminate the vulnerabilities)

Fixes hyperledger#2828

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
petermetz added a commit to petermetz/cacti that referenced this issue Nov 15, 2023
@petermetz
build(deps): bulk fix CVEs via dependency resolution overrides 2023-1…
d872903 
…0-23

1. Couldn't get rid of vulnerable versions in a couple of dependencies
because the underlying dependencies have gone ESM only which is a blocker
for us at the moment unfortunately.
2. Swapped out the ubiquity TS client to a version of it that I self
published onto npm after a full renovation of all of its dependencies.

Depends on hyperledger#2807 (because that one also has a couple of dependency bumps
that are needed to eliminate the vulnerabilities)

Fixes hyperledger#2828

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
petermetz added a commit to petermetz/cacti that referenced this issue Nov 15, 2023
@petermetz
build(deps): bulk fix CVEs via dependency resolution overrides 2023-1…
d750adc 
…0-23

1. Couldn't get rid of vulnerable versions in a couple of dependencies
because the underlying dependencies have gone ESM only which is a blocker
for us at the moment unfortunately.
2. Swapped out the ubiquity TS client to a version of it that I self
published onto npm after a full renovation of all of its dependencies.

Depends on hyperledger#2807 (because that one also has a couple of dependency bumps
that are needed to eliminate the vulnerabilities)

Fixes hyperledger#2828

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
petermetz added a commit that referenced this issue Nov 15, 2023
@petermetz
build(deps): bulk fix CVEs via dependency resolution overrides 2023-1…
2510ff5 
…0-23

1. Couldn't get rid of vulnerable versions in a couple of dependencies
because the underlying dependencies have gone ESM only which is a blocker
for us at the moment unfortunately.
2. Swapped out the ubiquity TS client to a version of it that I self
published onto npm after a full renovation of all of its dependencies.

Depends on #2807 (because that one also has a couple of dependency bumps
that are needed to eliminate the vulnerabilities)

Fixes #2828

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
sandeepnRES pushed a commit to sandeepnRES/cacti that referenced this issue Dec 21, 2023
@petermetz @sandeepnRES
build(deps): bulk fix CVEs via dependency resolution overrides 2023-1…
4279503 
…0-23

1. Couldn't get rid of vulnerable versions in a couple of dependencies
because the underlying dependencies have gone ESM only which is a blocker
for us at the moment unfortunately.
2. Swapped out the ubiquity TS client to a version of it that I self
published onto npm after a full renovation of all of its dependencies.

Depends on hyperledger#2807 (because that one also has a couple of dependency bumps
that are needed to eliminate the vulnerabilities)

Fixes hyperledger#2828

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@petermetz petermetz

Labels
dependencies Pull requests that update a dependency file P1 Priority 1: Highest Security Related to existing or potential security vulnerabilities
Projects
None yet
Milestone
v2.0.0
Development

Successfully merging a pull request may close this issue.

build(deps): bulk fix CVEs via dependency resolution overrides 2023-10-23 petermetz/cacti
1 participant
@petermetz