watchpack icon indicating copy to clipboard operation
watchpack copied to clipboard

fix: resolve vulnerabilities in watchpack dependencies

Open riyadbabouri opened this issue 1 year ago • 2 comments

In this pull request, I updated mocha to the latest version to resolve several security vulnerabilities in outdated dependencies, including:

  • minimatch: ReDoS vulnerability (GHSA-f8q6-p94x-37v3)
  • minimist: Prototype Pollution vulnerability (GHSA-vh95-rmgr-6w4m, GHSA-xvch-5gv4-984h)
  • mkdirp: Dependencies that rely on vulnerable versions of minimist and minimatch.

By updating Mocha, these vulnerabilities are mitigated, improving the overall security of the project.

riyadbabouri avatar Oct 06 '24 18:10 riyadbabouri

CLA Signed

The committers listed above are authorized under a signed CLA.

  • :white_check_mark: login: riyadbabouri (92cbef72fde4e89087d62d52342bea518efd7d1c)

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 91.99%. Comparing base (1a1feae) to head (92cbef7). Report is 4 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #246   +/-   ##
=======================================
  Coverage   91.99%   91.99%           
=======================================
  Files           6        6           
  Lines        1049     1049           
  Branches      253      253           
=======================================
  Hits          965      965           
  Misses         84       84           
Flag Coverage Δ
integration 91.99% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

:rocket: New features to boost your workflow:
  • :snowflake: Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • :package: JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

codecov[bot] avatar Oct 08 '24 13:10 codecov[bot]

Fixed in master

alexander-akait avatar May 16 '25 18:05 alexander-akait