Skip to content
This repository was archived by the owner on Feb 11, 2020. It is now read-only.

Commit 5409f74

Browse files
snyk-botChristopher DeCairos
snyk-bot
authored and
Christopher DeCairos
committed
[Snyk] Fix for 29 vulnerable dependency paths (#1967)
* fix: package.json & .snyk to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/npm:minimatch:20160620 - https://snyk.io/vuln/npm:braces:20180219 The following vulnerabilities are fixed with a Snyk patch: - https://snyk.io/vuln/npm:debug:20170905 - https://snyk.io/vuln/npm:moment:20160126 The following vulnerabilities are ignored: - https://snyk.io/vuln/npm:growl:20160721 - https://snyk.io/vuln/npm:hoek:20180212 - https://snyk.io/vuln/npm:lodash:20180130 - https://snyk.io/vuln/npm:moment:20161019 - https://snyk.io/vuln/npm:moment:20170905 Latest report for mozilla/donate.mozilla.org: https://snyk.io/test/github/mozilla/donate.mozilla.org * update extract-text-webpack-plugin * updating dependencies and webpack * Absolute output path * apply snyk provided patches for vulnerable dependencies * remove loaders, in favour of rules
1 parent bfc1735 commit 5409f74

File tree

3 files changed

+115
-26
lines changed

3 files changed

+115
-26
lines changed

‎.snyk

+89
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
2+
version: v1.10.2
3+
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
4+
ignore:
5+
'npm:growl:20160721':
6+
- polyfill-service > mocha > growl:
7+
reason: None given
8+
expires: '2018-04-01T19:56:45.294Z'
9+
'npm:hoek:20180212':
10+
- good-console-logfmt > hoek:
11+
reason: None given
12+
expires: '2018-04-01T19:56:45.295Z'
13+
- good-console-logfmt > good-squeeze > hoek:
14+
reason: None given
15+
expires: '2018-04-01T19:56:45.295Z'
16+
- babel-cli > chokidar > fsevents > node-pre-gyp > hawk > hoek:
17+
reason: None given
18+
expires: '2018-04-01T19:56:45.295Z'
19+
- webpack > watchpack > chokidar > fsevents > node-pre-gyp > hawk > hoek:
20+
reason: None given
21+
expires: '2018-04-01T19:56:45.295Z'
22+
- babel-cli > chokidar > fsevents > node-pre-gyp > request > hawk > hoek:
23+
reason: None given
24+
expires: '2018-04-01T19:56:45.295Z'
25+
- webpack > watchpack > chokidar > fsevents > node-pre-gyp > request > hawk > hoek:
26+
reason: None given
27+
expires: '2018-04-01T19:56:45.295Z'
28+
- babel-cli > chokidar > fsevents > node-pre-gyp > hawk > boom > hoek:
29+
reason: None given
30+
expires: '2018-04-01T19:56:45.295Z'
31+
- webpack > watchpack > chokidar > fsevents > node-pre-gyp > hawk > boom > hoek:
32+
reason: None given
33+
expires: '2018-04-01T19:56:45.295Z'
34+
- babel-cli > chokidar > fsevents > node-pre-gyp > hawk > cryptiles > boom > hoek:
35+
reason: None given
36+
expires: '2018-04-01T19:56:45.295Z'
37+
- webpack > watchpack > chokidar > fsevents > node-pre-gyp > hawk > cryptiles > boom > hoek:
38+
reason: None given
39+
expires: '2018-04-01T19:56:45.295Z'
40+
- babel-cli > chokidar > fsevents > node-pre-gyp > request > hawk > cryptiles > boom > hoek:
41+
reason: None given
42+
expires: '2018-04-01T19:56:45.295Z'
43+
- webpack > watchpack > chokidar > fsevents > node-pre-gyp > request > hawk > cryptiles > boom > hoek:
44+
reason: None given
45+
expires: '2018-04-01T19:56:45.295Z'
46+
- babel-cli > chokidar > fsevents > node-pre-gyp > request > hawk > boom > hoek:
47+
reason: None given
48+
expires: '2018-04-01T19:56:45.295Z'
49+
- webpack > watchpack > chokidar > fsevents > node-pre-gyp > request > hawk > boom > hoek:
50+
reason: None given
51+
expires: '2018-04-01T19:56:45.295Z'
52+
- babel-cli > chokidar > fsevents > node-pre-gyp > hawk > sntp > hoek:
53+
reason: None given
54+
expires: '2018-04-01T19:56:45.295Z'
55+
- webpack > watchpack > chokidar > fsevents > node-pre-gyp > hawk > sntp > hoek:
56+
reason: None given
57+
expires: '2018-04-01T19:56:45.295Z'
58+
- babel-cli > chokidar > fsevents > node-pre-gyp > request > hawk > sntp > hoek:
59+
reason: None given
60+
expires: '2018-04-01T19:56:45.295Z'
61+
- webpack > watchpack > chokidar > fsevents > node-pre-gyp > request > hawk > sntp > hoek:
62+
reason: None given
63+
expires: '2018-04-01T19:56:45.295Z'
64+
'npm:lodash:20180130':
65+
- good-console-logfmt > logfmt > lodash:
66+
reason: None given
67+
expires: '2018-04-01T19:56:45.296Z'
68+
- polyfill-service > grunt > grunt-legacy-util > lodash:
69+
reason: None given
70+
expires: '2018-04-01T19:56:45.296Z'
71+
- polyfill-service > grunt > grunt-legacy-log > grunt-legacy-log-utils > lodash:
72+
reason: None given
73+
expires: '2018-04-01T19:56:45.296Z'
74+
'npm:moment:20161019':
75+
- good-console-logfmt > moment:
76+
reason: None given
77+
expires: '2018-04-01T19:56:45.296Z'
78+
'npm:moment:20170905':
79+
- good-console-logfmt > moment:
80+
reason: None given
81+
expires: '2018-04-01T19:56:45.296Z'
82+
# patches apply the minimum changes required to fix a vulnerability
83+
patch:
84+
'npm:debug:20170905':
85+
- polyfill-service > mocha > debug:
86+
patched: '2018-03-02T19:56:45.299Z'
87+
'npm:moment:20160126':
88+
- good-console-logfmt > moment:
89+
patched: '2018-03-02T19:56:45.299Z'

‎package.json

+15-11
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
"build:l10njson": "pontoon-to-json --dest ./public",
99
"build:exchangerates": "node scripts/exchangerates.js",
1010
"build:babel": "babel src --compact=true -s --out-dir dist",
11-
"build:webpack": "webpack --optimize-minimize --optimize-dedupe",
11+
"build:webpack": "webpack --optimize-minimize",
1212
"watch:js": "npm-run-all --parallel watch:babel watch:webpack",
1313
"watch:babel": "npm run build:babel -- -w",
1414
"watch:webpack": "webpack --progress --profile --colors --watch",
@@ -22,7 +22,9 @@
2222
"test:depcheck": "dependency-check ./package.json",
2323
"test:lint": "eslint --ext .js,.jsx .",
2424
"imagemin": "imagemin assets/images/* assets/images",
25-
"postinstall": "npm-run-all build:*"
25+
"postinstall": "npm-run-all build:*",
26+
"snyk-protect": "snyk protect",
27+
"prepare": "npm run snyk-protect"
2628
},
2729
"repository": {
2830
"type": "git",
@@ -45,21 +47,21 @@
4547
"async": "1.5.1",
4648
"aws-sdk": "^2.176.0",
4749
"babel-cli": "6.9.0",
48-
"babel-core": "6.9.0",
49-
"babel-loader": "6.2.1",
50+
"babel-core": "6.10.4",
51+
"babel-loader": "7.1.3",
5052
"babel-preset-es2015": "6.3.13",
5153
"babel-preset-react": "6.11.1",
5254
"bestlang": "0.0.1",
5355
"blankie": "4.0.0",
5456
"boom": "7.1.1",
55-
"css-loader": "0.23.1",
57+
"css-loader": "0.28.4",
5658
"enhanced-require": "0.5.0-beta6",
5759
"enzyme": "2.7.0",
5860
"eslint": "4.11.0",
5961
"eslint-loader": "1.1.1",
6062
"eslint-plugin-react": "3.14.0",
6163
"exports-loader": "0.6.2",
62-
"extract-text-webpack-plugin": "0.9.1",
64+
"extract-text-webpack-plugin": "3.0.2",
6365
"good": "8.0.0-rc1",
6466
"good-console": "^7.0.0",
6567
"good-console-logfmt": "1.0.2",
@@ -75,7 +77,7 @@
7577
"json-loader": "0.5.4",
7678
"langmap": "0.0.12",
7779
"less": "2.5.3",
78-
"less-loader": "2.2.2",
80+
"less-loader": "4.0.6",
7981
"npm-run-all": "1.4.0",
8082
"object-assign": "4.1.0",
8183
"on-build-webpack": "0.1.0",
@@ -93,10 +95,11 @@
9395
"request": "2.83.0",
9496
"scooter": "5.0.0",
9597
"stripe": "5.1.1",
96-
"style-loader": "0.13.0",
98+
"style-loader": "0.18.2",
9799
"throng": "4.0.0",
98-
"webpack": "1.12.9",
99-
"whatwg-fetch": "0.10.1"
100+
"webpack": "3.2.0",
101+
"whatwg-fetch": "0.10.1",
102+
"snyk": "^1.69.10"
100103
},
101104
"devDependencies": {
102105
"cross-spawn": "2.1.4",
@@ -120,5 +123,6 @@
120123
},
121124
"engines": {
122125
"node": "^8.9.0"
123-
}
126+
},
127+
"snyk": true
124128
}

‎webpack.config.js

+11-15
Original file line numberDiff line numberDiff line change
@@ -10,32 +10,28 @@ module.exports = {
1010
output: {
1111
filename: '[name].[hash].js',
1212
chunkFilename: '[id].chunk.js',
13-
path: Path.join('public')
13+
path: Path.join( __dirname, './public')
1414
},
1515
resolve: {
16-
extensions: ['', '.js']
16+
extensions: ['.js']
1717
},
1818
module: {
19-
loaders: [
20-
{ test: /\.json$/, loaders: ['json-loader'], exclude: ['node_modules'] },
21-
{ test: /\.less$/, loader: ExtractTextPlugin.extract(
22-
'css?sourceMap!less?sourceMap'
23-
), exclude: ['node_modules'] }
24-
],
25-
preLoaders: [
26-
{ test: /\.jsx$/, loaders: ['eslint-loader'], exclude: ['node_modules'] }
19+
rules: [
20+
{ test: /\.json$/, loader: 'json-loader', exclude: ['node_modules'] },
21+
{ test: /\.jsx$/, enforce: 'pre', loader: 'eslint-loader', exclude: ['node_modules'] },
22+
{ test: /\.less$/, use: ExtractTextPlugin.extract({
23+
fallback: 'style-loader',
24+
use: ['css-loader', 'less-loader']
25+
})
26+
}
2727
]
2828
},
29-
eslint: {
30-
emitError: true,
31-
emitWarning: true
32-
},
3329
plugins: [
3430
new AssetsPlugin({
3531
path: Path.join(__dirname, 'public')
3632
}),
3733
new webpack.ProvidePlugin({
38-
'fetch': 'imports?this=>global!exports?global.fetch!whatwg-fetch'
34+
'fetch': 'imports-loader?this=>global!exports-loader?global.fetch!whatwg-fetch'
3935
}),
4036
new ExtractTextPlugin("style.[hash].css", {
4137
allChunks: true

0 commit comments

Comments
 (0)