chore: vulnerability scanning updates #1444
Conversation
iFergal
requested review from
rcmorano
and removed request for
jorgenavben and
sdisalvo-crd
| "web-vitals": "^2.1.4" | ||
| }, | ||
| "devDependencies": { | ||
| "@capacitor/assets": "^3.0.5", |
There was a problem hiding this comment.
@sdisalvo-crd @Sotatek-DukeVu @jorgenavben I'm removing this, and we can instead have whoever is periodically updating the assets to install this globally on their machine - it's not worth including as an additional dependency (which I would like to work on stripping down as we have a mountain of them right now)
| } | ||
| } | ||
| "GHSA-2p57-rm9w-gvfp", // SSRF attacks not relevant to our usage of Meerkat | ||
| "GHSA-4hjh-wcwx-xvwj", // e2e tests |
There was a problem hiding this comment.
I intend on re-evaluating some of these properly in case they pose some risk, even if a dev dependency. But I think it's easier to just blanket update appium and all related e2e dependencies tomorrow.
…026 when they can be re-reviewed
…ar file in the repo/depends
…lock only (tho currently it checks zero depends for some reason)
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
…iles in android/ and node_modules/
audit-ciwas only complaining about critical vulnerabilities but I would rather know about them all and ignore on a case-by-case basis. I will be re-evaluating the e2e test ones a bit closer later, as I think many of them can go away by bumping the appium server and related deps.