Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Scan for vulnerabilities on all dependencies recursively and ignore sweetalert2 #417

Closed
2 tasks done
st3phhays opened this issue Sep 24, 2024 · 0 comments
Closed
2 tasks done

Scan for vulnerabilities on all dependencies recursively and ignore sweetalert2 #417

st3phhays opened this issue Sep 24, 2024 · 0 comments
Assignees
@st3phhays
Labels
4 - Done Code has been added to the repository, and has been reviewed by a team member Improvement Issues that enhances existing functionality, or adds new features
Milestone
0.8.1

Comments

@st3phhays
Copy link
Member

st3phhays commented Sep 24, 2024 •
edited
Loading

Checklist

  • I have verified this is the correct repository for opening this issue.
  • I have verified no other issues exist related to my request.

Is Your Feature Request Related To A Problem? Please describe.

Right now, in the audit.yaml file, we are running yarn npm audit --severity moderate, however, this does not seem to scan enough dependencies to catch everything that might be reported by Dependabot. In addition, it reports a low severity vulnerability for sweetalert2, which we have deemed to be ignorable.

Describe The Solution. Why is it needed?

We should instead change the command to: yarn npm audit --all --recursive --ignore 1094698 to ensure that all dependencies are audited recursively. This will ensure that we catch all vulnerabilities before shipping. This also ignores the specific vulnerability ID for sweetalert2 found at GHSA-mrr8-v49w-3333.

Additional Context

Related Issues

No response
@st3phhays st3phhays added the Improvement Issues that enhances existing functionality, or adds new features label Sep 24, 2024
@st3phhays st3phhays self-assigned this Sep 24, 2024
@st3phhays st3phhays added the 2 - Working A user or team member has started working on the issue label Sep 24, 2024
@st3phhays st3phhays added this to the 0.8.1 milestone Sep 24, 2024
@st3phhays st3phhays changed the title Scan for vulnerabilities on all dependencies recursively Scan for vulnerabilities on all dependencies recursively and ignore sweetalert2 Sep 24, 2024
st3phhays added a commit to st3phhays/choco-theme that referenced this issue Sep 24, 2024
@st3phhays
(chocolatey#417) Update yarn npm audit command
40d5115 
This updates the yarn npm audit command to include all severity
types, scan dependencies recursively, and also ignores the known
vulnerability in sweetalert2.

This command has been added to the readme, which can be ran locally
after `yarn` has been ran. In addition, this has been updated in the
audit.yaml file that is ran before choco-theme is released.
This was referenced Sep 25, 2024
Closed
Merged
@st3phhays st3phhays added 3 - Review Code has been added, and is available for review as a pull request and removed 2 - Working A user or team member has started working on the issue labels Oct 2, 2024
alexaveldanez added a commit that referenced this issue Oct 2, 2024
@alexaveldanez
Merge pull request #420 from chocolatey/release/0.8.1
875bbfa 
(#415)(#416)(#417)(#418) choco-theme 0.8.1
@st3phhays st3phhays added 4 - Done Code has been added to the repository, and has been reviewed by a team member and removed 3 - Review Code has been added, and is available for review as a pull request labels Oct 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@st3phhays st3phhays

Labels
4 - Done Code has been added to the repository, and has been reviewed by a team member Improvement Issues that enhances existing functionality, or adds new features
Projects
None yet
Milestone
0.8.1
Development

No branches or pull requests
1 participant
@st3phhays