[Snyk Update] New fixes for 16 vulnerable dependency paths #173
Conversation
The following vulnerabilities are fixed with a Snyk patch: - https://snyk.io/vuln/npm:debug:20170905 - https://snyk.io/vuln/npm:ms:20170412 Latest report for janitortechnology/janitor: https://snyk.io/test/github/janitortechnology/janitor
There was a problem hiding this comment.
I'm not sure I like this change yet, and would like to know more about the detected vulnerabilities and their fixes. Let's only apply Synk's requested changes if they provide unquestionable value to the project.
For what it's worth, all the detected vulnerabilities seem to reside in camp's socket.io module, which by default isn't loaded until you use it (and we don't: search for occurrences of app.io or proxy.io, which is the getter that loads socket.io). Moreover, camp's socket.io module is deprecated, so it will probably (hopefully) be removed soon.
|
Closing because this PR doesn't add value. |
|
I opened espadrine/sc#64 to propose we drop We don't use or need it, even though it comprises about 50% of our NPM dependency tree. |
This project has vulnerabilities that could not be fixed, or were patched when no upgrade was available. Good news, new upgrades or patches have now been published! This pull request fixes vulnerable dependencies you couldn’t previously address.
The PR includes:
package.jsonscripts and a Snyk policy (.snyk) file, which patch the vulnerabilities that can't be upgraded away and ignore vulnerabilities with no fixes.Vulnerabilities that will be fixed
With a Snyk patch:
You can read more about Snyk's upgrade and patch logic in Snyk's documentation.
Note that this pull request only addresses vulnerabilities that previously had no fixes. See the Snyk test report to review and remediate the full list of vulnerable dependencies.
Check the changes in this PR to ensure they won't cause issues with your project.
Stay secure,
The Snyk team