Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build: FORMS-1870 Updated package vite in Components and frontend projects #1625

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

revanth-banala
Copy link
Collaborator

Description

Update package vite so that security vulnerabilities are fixed

The GitHub Dependabot process has created an alert for the esbuild dependency. Since esbuild is a sub-dependency of our dependency vite, we should update vite to the latest version. This needs to be done in both the components and frontend projects so that we are using a consistent version of vite.

To satisfy the requirements outlined in the Security Threat and Risk Assessment's (STRA) Statement of Acceptable Risks (SoAR), this vulnerability must be handled by updating the package version (or mitigated in some other way, if updating the package is not possible).
https://github.com/bcgov/common-hosted-form-service/security/dependabot/224
https://github.com/bcgov/common-hosted-form-service/security/dependabot/225

Acceptance Criteria
We are using the latest version of vite in both the components and the frontend projects

The vite update also results in esbuild being updated to >=0.25.0

Type of Change

build (change in build system or dependencies)

Checklist

  • I have read the CONTRIBUTING doc
  • I have checked that unit tests pass locally with my changes
  • I have run the npm script lint on the frontend and backend
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate)
  • I have approval from the product owner for the contribution in this pull request

Further comments

@revanth-banala revanth-banala marked this pull request as ready for review February 26, 2025 22:06
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant