Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): upgrade decode-uri-component to >= 0.2.2 #2243

Closed
petermetz opened this issue Dec 25, 2022 · 4 comments · Fixed by #2296
Closed

chore(deps): upgrade decode-uri-component to >= 0.2.2 #2243

petermetz opened this issue Dec 25, 2022 · 4 comments · Fixed by #2296
Assignees
Labels
dependencies Pull requests that update a dependency file good-first-issue Good for newcomers good-first-issue-400-expert P1 Priority 1: Highest Security Related to existing or potential security vulnerabilities

Comments

@petermetz
Copy link
Contributor

Description

The robot sent in a PR [1] to force the the transitive dependency upgrades via the lockfile without touching our actual dependencies, but we should follow-up to that by upgrading the direct dependencies as well so that in the event of the lock file getting wiped and recreated (which sometimes is necessary/hard to avoid) we won't fall back into having these vulnerabilities again.

[1] #2226

$ npm ls  decode-uri-component
@hyperledger/cactus@ /..../cactus
├─┬ @hyperledger/[email protected] -> ./packages/cactus-cmd-socketio-server
│ └─┬ [email protected]
│   └─┬ [email protected]
│     └─┬ [email protected]
│       └─┬ [email protected]
│         └─┬ [email protected]
│           └── [email protected] deduped
├─┬ @hyperledger/[email protected] -> ./examples/cactus-example-carbon-accounting-frontend
│ └─┬ @angular-devkit/[email protected]
│   └─┬ [email protected]
│     └─┬ [email protected]
│       └─┬ [email protected]
│         └── [email protected] deduped
├─┬ @hyperledger/[email protected] -> ./packages/cactus-test-tooling
│ └─┬ [email protected]
│   └─┬ [email protected]
│     └── [email protected]
└─┬ @hyperledger/[email protected] -> ./packages/cactus-verifier-client
  └─┬ [email protected]
    └─┬ [email protected]
      └─┬ [email protected]
        └─┬ [email protected]
          └─┬ [email protected]
            └─┬ [email protected]
              └── [email protected] deduped
@petermetz petermetz added Security Related to existing or potential security vulnerabilities P1 Priority 1: Highest labels Dec 25, 2022
@petermetz petermetz self-assigned this Dec 25, 2022
@charellesandig
Copy link
Contributor

Hi @petermetz , I would like to work on this ticket. Thank you.

charellesandig added a commit to charellesandig/cactus that referenced this issue Feb 20, 2023
charellesandig added a commit to charellesandig/cactus that referenced this issue Feb 23, 2023
charellesandig added a commit to charellesandig/cactus that referenced this issue Feb 23, 2023
charellesandig added a commit to charellesandig/cactus that referenced this issue Feb 23, 2023
@petermetz
Copy link
Contributor Author

Hi @petermetz , I would like to work on this ticket. Thank you.

@charellesandig Thank you, assigning now!

petermetz pushed a commit to charellesandig/cactus that referenced this issue Mar 2, 2023
@adrianbatuto
Copy link
Contributor

Hi, I will be taking over this ticket from Charelle.

@petermetz
Copy link
Contributor Author

Hi, I will be taking over this ticket from Charelle.

@adrianbatuto You got it!

@petermetz petermetz added good-first-issue Good for newcomers dependencies Pull requests that update a dependency file good-first-issue-400-expert labels Jul 24, 2023
@petermetz petermetz changed the title chore(deps): upgrade decode-uri-component to > 0.2.2 chore(deps): upgrade decode-uri-component to >= 0.2.2 Jul 24, 2023
petermetz referenced this issue in charellesandig/cactus Jul 24, 2023
Fixes https://github.com/hyperledger/cacti/issues/2243

Co-authored-by: Peter Somogyvari <[email protected]>

Signed-off-by: Peter Somogyvari <[email protected]>
Signed-off-by: charelle.sandig <[email protected]>
petermetz referenced this issue in charellesandig/cactus Aug 15, 2023
Fixes https://github.com/hyperledger/cacti/issues/2243

Co-authored-by: Peter Somogyvari <[email protected]>

Signed-off-by: Peter Somogyvari <[email protected]>
Signed-off-by: charelle.sandig <[email protected]>
petermetz referenced this issue in charellesandig/cactus Aug 17, 2023
Fixes https://github.com/hyperledger/cacti/issues/2243

Co-authored-by: Peter Somogyvari <[email protected]>

Signed-off-by: Peter Somogyvari <[email protected]>
Signed-off-by: charelle.sandig <[email protected]>
petermetz referenced this issue in charellesandig/cactus Aug 17, 2023
Fixes https://github.com/hyperledger/cacti/issues/2243

Co-authored-by: Peter Somogyvari <[email protected]>

Signed-off-by: Peter Somogyvari <[email protected]>
Signed-off-by: charelle.sandig <[email protected]>
petermetz referenced this issue Aug 17, 2023
Fixes https://github.com/hyperledger/cacti/issues/2243

Co-authored-by: Peter Somogyvari <[email protected]>

Signed-off-by: Peter Somogyvari <[email protected]>
Signed-off-by: charelle.sandig <[email protected]>
sandeepnRES referenced this issue in sandeepnRES/cacti Dec 21, 2023
Fixes https://github.com/hyperledger/cacti/issues/2243

Co-authored-by: Peter Somogyvari <[email protected]>

Signed-off-by: Peter Somogyvari <[email protected]>
Signed-off-by: charelle.sandig <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file good-first-issue Good for newcomers good-first-issue-400-expert P1 Priority 1: Highest Security Related to existing or potential security vulnerabilities
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants