-
Notifications
You must be signed in to change notification settings - Fork 3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Resolve immer security alert #315
Comments
@macfarlandian new security alert for you. Since it's HIGH severity, we want to resolve it next week. Thanks! |
@jessex this alert seems to have resolved on its own? I'm not able to find what it was objecting to, nor do I see any recent version changes to that dependency in |
You're right. Was there a recent commit that may have changed the dependency graph? If not, then the CVE itself must have been updated such that it is no longer a vulnerability for us. FWIW, it remains active in the supervision-success-component repository here: https://github.com/Recidiviz/supervision-success-component/security/dependabot/yarn.lock/immer/open |
oh thanks, that helps! Oddly, we still have the very same transitive dependency on the same version of Over at the CRA repo they say there is no actual runtime vulnerability, which is good, but they also have a patch PR open. If that gets merged we ought to be able to upgrade |
@jessex do we want to keep this ticket open while we wait for an upstream update, or is this a |
With the security alert no longer active, we should close this and reopen this or a new issue if and when this becomes an active alert again. Thanks, Ian! |
What needs to be done? Why does it need to be done?
Resolve the HIGH severity
immer
security alert: https://github.com/Recidiviz/public-dashboard/security/dependabot/yarn.lock/immer/openAdditional context
This should be resolved within the week of January 25, 2021.
The text was updated successfully, but these errors were encountered: