Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade dependencies to resolve semver advisory #8752

Merged
merged 2 commits into from
Jul 11, 2023
Merged

Conversation

aduth
Copy link
Member

@aduth aduth commented Jul 11, 2023

馃洜 Summary of changes

Updates dependencies to resolve all security advisories related to semver.

This is a follow-up to #8659, where previously some dependencies could not be updated, since they were pinned to an older version of semver which had not been patched. The older versions have since been patched (semver@6.3.1, semver@5.7.2), so we can now resolve the advisory completely.

The approach largely follows this suggestion to remove and reinstall entries of affected packages from yarn.lock (specifically semver and core-js-compat), as well as upgrading stylelint to the latest version.

This removes the audit-ci tooling added in #8659, since we don't have a need for an allowlist at the moment, as all advisories have been addressed.

馃摐 Testing Plan

yarn audit produces a clean result.

changelog: Internal, Dependencies, Update dependencies to resolve security advisories
@aduth aduth merged commit d974d87 into main Jul 11, 2023
3 checks passed
@aduth aduth deleted the aduth-semver-upgrade branch July 11, 2023 15:34
@zachmargolis zachmargolis mentioned this pull request Jul 12, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants