Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Resolve vulnerabilities detected in NPM packages #24

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

Yash-007
Copy link

@Yash-007 Yash-007 commented Oct 21, 2024

Issue #19: Fixed - Resolve Multiple Vulnerabilities Detected in NPM Packages.

  • Upgrade Firebase from 9.22.0 to 11.0.0
  • Add npm-force-resolutions as dev dependency
  • Implement preinstall script for npm-force-resolutions
  • Add resolutions for nth-check and postcss

Note that the Firebase update is a major version change and may require additional testing to ensure compatibility.

Testing checklist:

  • Run npm audit to confirm vulnerability resolution
  • Verify app functionality with new Firebase version
  • Test all Firebase-related features

occ_bharat_seva_ss1

@vaibhavyadav-dev
Copy link
Member

@Yash-007 check there is some mismatch in your package-lock.json and package.json file file fix issue and make PR

@Yash-007
Copy link
Author

Yash-007 commented Oct 22, 2024

@vaibhavyadav-dev I've reviewed the files, there are no mismatches in terms of dependencies or versions listed in both files. I've made a pr, please check and let me know.

@vaibhavyadav-dev
Copy link
Member

@Yash-007 it seems like your branch has conflicts, please resolve it inorder to pass the checks

@Yash-007
Copy link
Author

@vaibhavyadav-dev The conflicts you’re seeing in my branch versus the main branch are primarily due to the security updates and dependency adjustments I made to address vulnerabilities in the project. Specifically:

  • updated several dependencies, such as firebase and Babel-related packages, to their latest secure versions.
  • added resolved URLs and integrity fields to ensure package authenticity and improve security.

These updates were necessary to mitigate security vulnerabilities in the outdated dependencies that were flagged during the review. I'm happy to help resolve any conflicts or discuss if there are alternate ways to address the vulnerabilities while minimizing changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants