Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build: FORMS-1758 update the cross-spawn dependency #1580

Merged
merged 1 commit into from
Jan 20, 2025

Conversation

WalterMoar
Copy link
Collaborator

Description

The GitHub Dependabot process has created an alert for the cross-spawn dependency. To satisfy the requirements outlined in the Security Threat and Risk Assessment's (STRA) Statement of Acceptable Risks (SoAR), this vulnerability must be handled by updating the package version (or mitigated in some other way, if updating the package is not possible).
https://github.com/bcgov/common-hosted-form-service/security/dependabot/216

Notes

  • cross-spawn is a dependency of eslint
  • Our eslint is v8.40.0, but latest is v9.18.0
  • Updating eslint to v9 would force updates of its dependencies, such as prettier
  • For this vulnerability fix we’ll just update cross-spawn and deal with eslint and prettier later

Acceptance Criteria

  • cross-spawn is no longer in dependabot’s list of vulnerabilities

Type of Change

build (change in build system or dependencies)

Checklist

  • I have read the CONTRIBUTING doc
  • I have checked that unit tests pass locally with my changes
  • I have run the npm script lint on the frontend and backend
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate)
  • I have approval from the product owner for the contribution in this pull request

Copy link
Collaborator

@jasonchung1871 jasonchung1871 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Manual testing of CHEFS features seems to work.

This is used by eslint. We're one major versions behind on it, but let's deal with those updates later.
@WalterMoar WalterMoar force-pushed the build/1758-cross-spawn-vuln branch from 7c1eeac to 5e64ead Compare January 20, 2025 21:19
@WalterMoar WalterMoar merged commit 5497b15 into bcgov:main Jan 20, 2025
5 checks passed
@WalterMoar WalterMoar deleted the build/1758-cross-spawn-vuln branch January 20, 2025 21:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants