-
-
Notifications
You must be signed in to change notification settings - Fork 515
[Snyk] Fix for 1 vulnerabilities #1618
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-3091012
CLAassistant
commented
Nov 2, 2022
CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.
Unfortunately, it's a useless auto-bump. 😕
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
IDE2 cannot do much with the PR.
Problems:
- The bot needs to sign the CLI. This is probably easy.
- The auto PR is shiny and tip-top but does not solve anything:
- First off, it creates a false public warning,
- Theia dependencies must be updated together, so bumping one or two of them will break the dependency injection as the same module will be under the
node_modulesmultiple times (this is how npm hoisting works), - The auto PR does not re-generate the
yarn.lockfile, so essentially, after a merge + pull cycle, all the devs will have an outgoing git change, and the new, partial Theia update will be indeterministic as the version is not pinned.
In summary, the way it works now does not solve anything but creates a false public warning on GH.
Closing as invalid. Feel free to reopen and take care of this PR if you disagree and want to handle the version update.
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to fix one or more vulnerable packages in the `yarn` dependencies of this project.
Changes included in this PR
Vulnerabilities that will be fixed
With an upgrade:
Why? Recently disclosed, Has a fix available, CVSS 9.8
SNYK-JS-SOCKETIOPARSER-3091012
(*) Note that the real score may have changed since the PR was raised.
Check the changes in this PR to ensure they won't cause issues with your project.
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
🛠 Adjust project settings
📚 Read more about Snyk's upgrade and patch logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Improper Input Validation