Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Resolve tough-cookie to ^4.1.3 #1876

Merged
merged 1 commit into from
Jul 13, 2023

Conversation

amgleitman
Copy link
Member

@amgleitman amgleitman commented Jul 10, 2023

Please select one of the following

  • I am removing an existing difference between facebook/react-native and microsoft/react-native-macos 👍
  • I am cherry-picking a change from Facebook's react-native into microsoft/react-native-macos 👍
  • I am making a fix / change for the macOS implementation of react-native
  • I am making a change required for Microsoft usage of react-native

Summary

Resolve tough-cookie to ^4.1.3 to resolve a security vulnerability.

tough-cookie is an indirect dependency of @definitelytyped/dtslint:

@definitelytyped/dtslint > @definitelytyped/utils > @qiwi/npm-registry-client > request > tough-cookie

Our particular usage of the request package doesn't seem to rely on cookies; any NPM registry client calls we make from @definitelytyped/utils appear to be one-shot calls. Therefore, this should be a rather innocuous change.

Changelog

[Internal] [Security] - Security updates

Test Plan

If the CIs pass, we should be good

@amgleitman amgleitman requested a review from a team as a code owner July 10, 2023 23:21
@github-actions
Copy link

github-actions bot commented Jul 10, 2023

Warnings
⚠️ 🔒 package.json - Changes were made to package.json. This will require a manual import by a Facebook employee.

Generated by 🚫 dangerJS against 609a34f

@Saadnajmi Saadnajmi merged commit 049610a into microsoft:main Jul 13, 2023
@amgleitman amgleitman deleted the tough-cookie-4.1.3 branch July 13, 2023 18:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants