-
-
Notifications
You must be signed in to change notification settings - Fork 9.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[dependencies] Remove dependency to trim newlines #18468
[dependencies] Remove dependency to trim newlines #18468
Conversation
the "x-default-browser" npm package has a dependency to "[email protected]", which contains a high severity security vulnerability (see: https://snyk.io/test/npm/trim-newlines/1.0.0). This commit replaces "x-default-browser" with "default-browser".
☁️ Nx Cloud ReportCI is running/has finished running commands for commit 2ea387c. As they complete they will appear below. Click to see the status, the terminal output, and the build insights. 📂 See all runs for this branch ✅ Successfully ran 1 targetSent with 💌 from NxCloud. |
Socket Security – Alert🧐 Potential typosquat detectedA package that was added in the pull request has a name similar to other popular packages. Use care when consuming similarly named packages and ensure that you did not intend to consume a different package. Malicious packages often publish using similar names as existing popular packages.
Powered by socket.dev |
@@ -50,7 +50,9 @@ module.exports = { | |||
'^.+\\.[jt]sx?$': '<rootDir>/scripts/utils/jest-transform-js.js', | |||
'^.+\\.mdx$': '@storybook/addon-docs/jest-transform-mdx', | |||
}, | |||
transformIgnorePatterns: ['/node_modules/(?!lit-html).+\\.js'], | |||
transformIgnorePatterns: [ | |||
'/node_modules/(?!lit-html|default-browser|bundle-name|run-applescript).+\\.js', |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
A better solution to this is welcome.
default-browser
, bundle-name
and run-applescript
are ESM modules
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I used dynamic import to solve this ESM thing.
@Aaronkala whoops, I just duplicated this in #18594 😢 |
@Aaronkala Thank you for this PR.. The issue relating the security of
So I'll close this PR. Thank you for your effort, time and energy you put into creating this PR. We truly appreciate it! |
Issue: #18287 (also related to #17220)
What I did
Some notes: "default-browser" is an ESM package so it was causing some issues in jest. I added the new ESM packages to the
transformIgnorePatterns
but I'm not sure if this is the best approach. Suggestions welcome here :)How to test
If your answer is yes to any of these, please make sure to include it in your PR.