Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[UNSAFE] build: update yarn.lock to fix audit output #16

Merged
merged 2 commits into from
Dec 31, 2023

Conversation

up-up-and-away[bot]
Copy link
Contributor

@up-up-and-away up-up-and-away bot commented Dec 1, 2023

We ran uuaw --audit and it resulted in a clean yarn audit.

Attempting to fix advisory: GHSA-pwfr-8pq7-x9qv - Unauthenticated Denial of Service in the octokit/webhooks library
Scanning dependency chain:
     probot --> @octokit/webhooks
[1/3] Trying from: @octokit/[email protected]
    Resolving: @octokit/[email protected] --> 7.21.0
[1/3] Chain results in vulnerable version: @octokit/[email protected]
[2/3] Trying from: probot@^11.0.1
    Resolving: probot@^11.0.1 --> 11.4.1
    Resolving: @octokit/[email protected] --> 7.21.0
[2/3] Chain results in vulnerable version: @octokit/[email protected]
[3/3] [UNSAFE] Trying from: probot@^12.0.0
    Resolving: probot@^12.0.0 --> 12.3.3
    Resolving: @octokit/webhooks@^9.26.3 --> 9.26.3
[3/3] [UNSAFE] Updating chain to latest starting at: probot@^12.0.0 results in a patched version: @octokit/[email protected]
[3/3] [UNSAFE] Running yarn install now

Attempting to fix advisory: GHSA-wf5p-g6vw-rhxx - Axios Cross-Site Request Forgery Vulnerability
Scanning dependency chain:
     @slack/web-api --> axios
[1/2] Trying from: axios@^0.21.1
    Resolving: axios@^0.21.1 --> 0.21.4
[1/2] Chain results in vulnerable version: [email protected]
[2/2] Trying from: @slack/web-api@^6.3.0
    Resolving: @slack/web-api@^6.3.0 --> 6.11.0
    Resolving: axios@^1.6.0 --> 1.6.3
[2/2] Updating chain to latest starting at: @slack/web-api@^6.3.0 results in a patched version: [email protected]
[2/2] Running yarn install now

Audit is clean, looking good cap'n

@up-up-and-away up-up-and-away bot requested a review from a team as a code owner December 1, 2023 15:09
@up-up-and-away up-up-and-away bot changed the title build: update yarn.lock to fix audit output [UNSAFE] build: update yarn.lock to fix audit output Dec 18, 2023
@up-up-and-away up-up-and-away bot force-pushed the auto-uuaw/root branch 2 times, most recently from b9cfb08 to 3e7fb68 Compare December 27, 2023 15:08
@codebytere codebytere merged commit 9cdd29d into main Dec 31, 2023
3 checks passed
@codebytere codebytere deleted the auto-uuaw/root branch December 31, 2023 10:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant