Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependencies to API v1 #1536

Merged
merged 1 commit into from
Feb 18, 2025
Merged

Conversation

ldjebran
Copy link
Contributor

@ldjebran ldjebran commented Feb 18, 2025

Jira Issue: https://issues.redhat.com/browse/AAP-37996

Description

Update dependencies to API version v1

Production deployment

  • This code change is ready for production on its own
  • This code change requires the following considerations before going to production:

Signed-off-by: Djebran Lezzoum <[email protected]>
@ldjebran ldjebran added the enhancement New feature or request label Feb 18, 2025
Copy link

# npm audit report

@vitest/browser  >=2.0.0-beta.1
Severity: critical
Depends on vulnerable versions of @vitest/mocker
Vitest browser mode serves arbitrary files - https://github.com/advisories/GHSA-8gvc-j273-4wm5
Depends on vulnerable versions of vitest
fix available via `npm audit fix`
node_modules/@vitest/browser
  @vitest/coverage-v8  2.0.0-beta.1 - 2.1.8
  Depends on vulnerable versions of @vitest/browser
  Depends on vulnerable versions of vitest
  node_modules/@vitest/coverage-v8
  vitest  0.0.1 - 0.0.12 || >=0.0.29
  Depends on vulnerable versions of @vitest/browser
  Depends on vulnerable versions of @vitest/mocker
  Depends on vulnerable versions of vite
  Depends on vulnerable versions of vite-node
  node_modules/vitest

dompurify  <3.2.4
Severity: moderate
DOMPurify allows Cross-site Scripting (XSS) - https://github.com/advisories/GHSA-vhxf-7vqr-mrjg
fix available via `npm audit fix`
node_modules/dompurify

esbuild  <=0.24.2
Severity: moderate
esbuild enables any website to send any requests to the development server and read the response - https://github.com/advisories/GHSA-67mh-4wv8-2f99
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/esbuild
  vite  >=0.11.0
  Depends on vulnerable versions of esbuild
  node_modules/vite
    @vitejs/plugin-react  >=2.0.0-alpha.0
    Depends on vulnerable versions of vite
    node_modules/@vitejs/plugin-react
    @vitest/mocker  *
    Depends on vulnerable versions of vite
    node_modules/@vitest/mocker
    vite-node  *
    Depends on vulnerable versions of vite
    node_modules/vite-node


9 vulnerabilities (6 moderate, 3 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Copy link

# npm audit report

serialize-javascript  <6.0.2
Severity: moderate
Cross-site Scripting (XSS) in serialize-javascript - https://github.com/advisories/GHSA-76p7-773f-r4q5
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/rollup-plugin-terser/node_modules/serialize-javascript
  rollup-plugin-terser  3.0.0 || >=4.0.4
  Depends on vulnerable versions of serialize-javascript
  node_modules/rollup-plugin-terser
    workbox-build  5.0.0-alpha.0 - 7.0.0
    Depends on vulnerable versions of rollup-plugin-terser
    node_modules/workbox-build
      workbox-webpack-plugin  5.0.0-alpha.0 - 7.0.0
      Depends on vulnerable versions of workbox-build
      node_modules/workbox-webpack-plugin

4 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

@ldjebran ldjebran marked this pull request as ready for review February 18, 2025 08:17
Copy link
Contributor

@manstis manstis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

Copy link
Contributor

@TamiTakamiya TamiTakamiya left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Although Michael already approved this, I also approve on the changes in chatbot codes. Thanks.

@ldjebran ldjebran merged commit 4fe966f into main Feb 18, 2025
13 of 15 checks passed
@ldjebran ldjebran deleted the ldjebran/update-dependencies-to-v1 branch February 18, 2025 13:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants