Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wr/npm8 #270

Merged
merged 2 commits into from
Jun 8, 2022
Merged

Wr/npm8 #270

merged 2 commits into from
Jun 8, 2022

Conversation

WillieRuemmele
Copy link
Contributor

What does this PR do?

bumps npm to v8 to remove vulnerable json-schema dependency
verify by

  1. git pull; yarn
  2. npm explain json-schema
  3. verify only v 0.4.0 is present

What issues does this PR fix or reference?

[skip-validate-pr]

@cristiand391 cristiand391 self-requested a review June 8, 2022 14:07
Copy link
Member

@cristiand391 cristiand391 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

QA notes

✅ plugins:trust:verify --npm @salesforce/plugin-org
Successfully validated digital signature for plugin-org

✅ plugins:trust:verify --npm @salesforce/plugin-org --json
json output matches

✅ can find npm location
this code was added so that plugin-trust can work when npm isn't in the PATH:
https://github.com/salesforcecli/plugin-trust/blob/wr/npm8/src/shared/npmCommand.ts#L83

Added a console.log to make sure it was working:
Screen Shot 2022-06-08 at 18 50 13

✅ throw same npm error when specifying a non-existent package

@cristiand391 cristiand391 merged commit af03a4d into main Jun 8, 2022
@cristiand391 cristiand391 deleted the wr/npm8 branch June 8, 2022 21:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants