Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build: FORMS-1687 nanoid vulnerability fix #1561

Merged
merged 1 commit into from
Dec 31, 2024

Conversation

WalterMoar
Copy link
Collaborator

Description

The GitHub Dependabot process has created an alert for the nanoid dependency. To satisfy the requirements outlined in the Security Threat and Risk Assessment's (STRA) Statement of Acceptable Risks (SoAR), this vulnerability must be handled by updating the package version (or mitigated in some other way, if updating the package is not possible).
https://github.com/bcgov/common-hosted-form-service/security/dependabot/219

Notes

  • Our package-lock.json is using nanoid v3.3.7
  • The nanoid fix version, and latest version, is v3.3.8
  • nanoid is a dependency of postcss (^3.3.7)
  • Our package-lock.json is using postcss v8.4.49, which is the latest version
  • postcss is a dependency of css-loader (^8.4.33)
  • Our package.json is using css-loader v7.1.2, which is the latest version

So by doing an update of nanoid we stay within the spec for the postcss dependencies.

Acceptance Criteria

  • The nanoid dependency no longer appears in the dependabot's list of packages with vulnerabilities

Type of Change

build (change in build system or dependencies)

Checklist

  • I have read the CONTRIBUTING doc
  • I have checked that unit tests pass locally with my changes
  • I have run the npm script lint on the frontend and backend
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate)
  • I have approval from the product owner for the contribution in this pull request

@WalterMoar WalterMoar marked this pull request as ready for review December 31, 2024 19:02
@WalterMoar WalterMoar merged commit 274b670 into bcgov:main Dec 31, 2024
5 checks passed
@WalterMoar WalterMoar deleted the build/1687-nanoid-vulnerability branch December 31, 2024 19:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant