Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: fix cross spawn vulnerability #6709

Merged
merged 1 commit into from
Dec 24, 2024
Merged

chore: fix cross spawn vulnerability #6709

merged 1 commit into from
Dec 24, 2024

Conversation

vikrantgupta25
Copy link
Collaborator

@vikrantgupta25 vikrantgupta25 commented Dec 24, 2024

Summary

  • add resolutions so that only cross-spawn : 7.0.5 is used in our code.

Related Issues / PR's

Screenshots

NA

Affected Areas and Manually Tested Areas

Copy link

Build Error! No Linked Issue found. Please link an issue or mention it in the body using #<issue_id>

@github-actions github-actions bot added bug Something isn't working chore labels Dec 24, 2024
Copy link
Contributor

@ellipsis-dev ellipsis-dev bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 Looks good to me! Reviewed everything up to 2809f46 in 9 seconds

More details
  • Looked at 13 lines of code in 1 files
  • Skipped 1 files when reviewing.
  • Skipped posting 2 drafted comments based on config settings.
1. frontend/package.json:246
  • Draft comment:
    Adding 'cross-spawn' to both dependencies and resolutions is redundant. It should be added only to resolutions if the intent is to enforce a specific version across all dependencies.
  • Reason this comment was not posted:
    Comment did not seem useful.
2. frontend/package.json:246
  • Draft comment:
    Ensure that the added resolution for 'cross-spawn' is necessary and does not conflict with other dependencies. If 'cross-spawn' is already specified in dependencies, the resolution might be redundant.
  • Reason this comment was not posted:
    Confidence changes required: 50%
    The addition of 'cross-spawn': '7.0.5' in both dependencies and resolutions is consistent with the PR's goal to fix a vulnerability by ensuring a specific version is used.

Workflow ID: wflow_Piv5dCY14CIcWgyB


You can customize Ellipsis with 👍 / 👎 feedback, review rules, user-specific overrides, quiet mode, and more.

Copy link

Build Error! No Linked Issue found. Please link an issue or mention it in the body using #<issue_id>

Copy link

Build Error! No Linked Issue found. Please link an issue or mention it in the body using #<issue_id>

@vikrantgupta25 vikrantgupta25 merged commit 5dfe245 into main Dec 24, 2024
17 of 21 checks passed
@vikrantgupta25 vikrantgupta25 deleted the fix-cross-spawn branch December 24, 2024 13:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working chore
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants