Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Fix for 1 vulnerabilities #770

Closed
wants to merge 1 commit into from

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `yarn` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • website/package.json
    • website/yarn.lock
    • website/.snyk

Vulnerabilities that will be fixed

With a Snyk patch:
Severity Issue Exploit Maturity
medium severity Prototype Pollution
SNYK-JS-LODASH-567746
Proof of Concept

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

…e vulnerabilities

The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
@vercel
Copy link

vercel bot commented Jul 17, 2020

This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployment, click below or on the icon next to each commit.

🔍 Inspect: https://vercel.com/formik/tsdx/jkuwta0ws
✅ Preview: https://tsdx-git-snyk-fix-c1e9e8e302fe06d5d8ff30c0b353d3e3.formik.vercel.app

@agilgur5 agilgur5 added solution: unnecessary This PR makes unnecessary or redundant changes solution: duplicate This issue or pull request already exists labels Aug 25, 2020
@agilgur5
Copy link
Collaborator

unnecessary to update /website, but also duplicates #768 / #818 . not sure why it added its own patch instead of just updating the dep

@jaredpalmer
Copy link
Owner

I just deleted my Snyk account. I will install dependabot on formium when I get to office in am. Been using it on another project and it’s pretty good. I’ll set it to do weekly dep checks so we can do other things with our lives

@agilgur5
Copy link
Collaborator

agilgur5 commented Aug 25, 2020

I just deleted my Snyk account.

Thanks Jared. I think that'll stop the updates but you might want to clear the permissions you gave to Snyk (it actually commits as a user and not as a bot since they don't have an app for some reason)

I will install dependabot on formium when I get to office in am. Been using it on another project and it’s pretty good. I’ll set it to do weekly dep checks so we can do other things with our lives

Agreed that weekly would be a lot better than this multiple times a day current monstrosity but still have some issues with unnecessary dep upgrades when they're not pinned anyway. Can continue any discussion of that on #839 though

@agilgur5
Copy link
Collaborator

agilgur5 commented Aug 31, 2020

Snyk has been removed per above. Closing as unnecessary since this updated a dep on /website dir, which isn't a library. And because this effectively duplicated other PRs per above and added a patch instead of just updating weirdly enough.

Snyk has been replaced with dependabot per #839 / #846 . Will go through and cleanup all the Snyk branches now.

EDIT: deleted 10+ Snyk branches. Also deleted a multitude of Greenkeeper branches but won't delete the rest since there are still some open Greenkeeper PRs that should be merged/superseded but require breaking changes so will be batched later.

@agilgur5 agilgur5 closed this Aug 31, 2020
Repository owner locked as resolved and limited conversation to collaborators Aug 31, 2020
@agilgur5 agilgur5 deleted the snyk-fix-c1e9e8e302fe06d5d8ff30c0b353d3e3 branch August 31, 2020 15:58
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
solution: duplicate This issue or pull request already exists solution: unnecessary This PR makes unnecessary or redundant changes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants