Conversation
|
Finished testing dependencies reducing vulnerabilities from 65 vulnerabilities (46 moderate, 18 high, 1 critical) to The majority of the remaining vulnerabilities are require more refactoring and appear to be primarily DDOS-related openings. Remaining vulnerability report attached below. I'll make some additional tickets for each of these. |
not-fritos
requested review from
Copilot and
kylie-taitano
and removed request for
Copilot and
kylie-taitano
There was a problem hiding this comment.
Pull Request Overview
This PR addresses security vulnerabilities by updating dependency versions, adds a null check in a JSON string replacement utility, and refactors CLI markdown generation to include a generated-file header.
- Added a null/undefined guard in
replaceStringsInJsonBlob - Bumped project version and updated multiple dependencies to newer releases
- Introduced a constant header and refactored summary/projects markdown generation in the CLI
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| pxtlib/main.ts | Added a null check at the start of replaceStringsInJsonBlob |
| package.json | Incremented version and updated several dependencies to patch vulnerabilities |
| cli/cli.ts | Added GENERATED_FILE_DECLARATION and refactored markdown assembly |
Comments suppressed due to low confidence (3)
pxtlib/main.ts:181
- Consider adding unit tests for
replaceStringsInJsonBlobthat covernullandundefinedinputs to verify the new guard behaves as expected.
if (blobPart == null) {
package.json:135
- Gulp v5 is not yet officially released; this version bump may cause install failures. Verify that v5 exists or pin to a valid released version to avoid build breakage.
"gulp": "^5.0.1",
cli/cli.ts:1965
- [nitpick] The array-based assembly of
PROJECTS_MD_CONTENTcould be simplified and made more readable by using a single template literal instead of multiple array entries andjoincalls.
const PROJECTS_MD_CONTENT = [
|
I think there's one more test that's failing here that I need to investigate |
1 participant
fixing vulnerabilities