chore: upgrade moment to latest version to fix CVE #9005
Conversation
Signed-off-by: Alexander Matyushentsev <AMatyushentsev@gmail.com>
There was a problem hiding this comment.
lgtm, thanks for the quick fix!
I'd like to avoid this blocking any future security fixes in release-2.1 through release-2.3. Any opposition to my cherry-picking this back?
Alternatively, I could add an ignore rule to the .snyk file, since this vulnerability doesn't really affect us.
|
I would cherry-pick it. It is probably the same amount of work |
Codecov Report
@@ Coverage Diff @@
## master #9005 +/- ##
==========================================
- Coverage 45.07% 45.03% -0.05%
==========================================
Files 212 212
Lines 25281 25281
==========================================
- Hits 11396 11385 -11
- Misses 12278 12292 +14
+ Partials 1607 1604 -3
Continue to review full report at Codecov.
|
Signed-off-by: Alexander Matyushentsev <AMatyushentsev@gmail.com> Signed-off-by: asingh51 <Ashutosh_Singh@intuit.com>
Signed-off-by: Alexander Matyushentsev <AMatyushentsev@gmail.com> Signed-off-by: wojtekidd <wojtek.cichon@protonmail.com>
crenshaw-dev
added
cherry-pick/2.2
Signed-off-by: Alexander Matyushentsev <AMatyushentsev@gmail.com>
|
Cherry-picked onto release-2.2 for 2.2.12 and release-2.3 for 2.3.7. |
Signed-off-by: Alexander Matyushentsev <AMatyushentsev@gmail.com>
Signed-off-by: Alexander Matyushentsev AMatyushentsev@gmail.com
PR upgrades
momentto latest version and fixes https://security.snyk.io/vuln/SNYK-JS-MOMENT-2440688 . Argo CD is not really affected sincemomentis used only on client side but good to fix it since it fails CI.