Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update security issues #5

Merged
merged 6 commits into from
Oct 29, 2024
Merged

Update security issues #5

merged 6 commits into from
Oct 29, 2024

Conversation

poffdeluxe
Copy link
Collaborator

@poffdeluxe poffdeluxe commented Oct 29, 2024

Recommend reviewing this per commit. The following has been changed:

  1. Temporarily removing e2e tests since they depend on some old packages that have critical vulnerabilities
  2. Removing codeowners file
  3. Removing the third-party workflows (including the workflow with a dangerous security issue)
  4. Remove and update some dependencies to address critical/high security vulnerabilities
  5. BONUS: reverted a commit that broke file importing from GCS (necessary feature for our usecase)

The remaining vulnerabilities according to osv-scanner:

╭─────────────────────────────────────┬──────┬───────────┬─────────────────┬─────────┬───────────────╮
│ OSV URL                             │ CVSS │ ECOSYSTEM │ PACKAGE         │ VERSION │ SOURCE        │
├─────────────────────────────────────┼──────┼───────────┼─────────────────┼─────────┼───────────────┤
│ https://osv.dev/GHSA-593m-55hh-j8gv │ 6.3  │ npm       │ @sentry/browser │ 6.19.7  │ web/yarn.lock │
│ https://osv.dev/GHSA-pxg6-pf52-xh8x │      │ npm       │ cookie          │ 0.4.2   │ web/yarn.lock │
│ https://osv.dev/GHSA-pxg6-pf52-xh8x │      │ npm       │ cookie          │ 0.6.0   │ web/yarn.lock │
│ https://osv.dev/GHSA-2p57-rm9w-gvfp │ 8.1  │ npm       │ ip              │ 2.0.1   │ web/yarn.lock │
│ https://osv.dev/GHSA-x565-32qp-m3vf │ 4.3  │ npm       │ phin            │ 2.9.3   │ web/yarn.lock │
│ https://osv.dev/GHSA-25hc-qcg6-38wj │ 7.3  │ npm       │ socket.io       │ 2.5.0   │ web/yarn.lock │
╰─────────────────────────────────────┴──────┴───────────┴─────────────────┴─────────┴───────────────╯

@poffdeluxe poffdeluxe requested a review from mmaraya October 29, 2024 15:10
Copy link

@mmaraya mmaraya left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@poffdeluxe poffdeluxe merged commit d3daedf into develop Oct 29, 2024
4 checks passed
@poffdeluxe poffdeluxe deleted the poff/update-vulns branch October 29, 2024 21:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants