GeezerVisonThe World Wide Web, restored to 800 pixels of glory. |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites |
GeezerVison is showing github.com — chore/deps: bump vulnerable dependencies ahead of 7.6.0 release by andreeleuterio · Pull Request #1357 · sourcegraph/src-cli Conversation
Member
Bumping dependencies to clean up CVEs before the monorepo 7.6.0 release
Sorry, something went wrong. Uh oh!
There was an error while loading. Please reload this page. All reactionsBumps golang.org/x/crypto, x/net, x/text, google.golang.org/grpc, and github.com/yuin/goldmark in the root module, x/net and x/text in lib, and tar in npm-distribution. Cleans all Trivy HIGH/CRITICAL findings and all govulncheck-reachable vulnerabilities.
andreeleuterio
enabled auto-merge (squash)
cbrnrd
approved these changes
Uh oh!
There was an error while loading. Please reload this page.
marcleblanc2
added a commit
that referenced
this pull request
The overrides block was added in #1218 and #1219 to force patched versions of cross-spawn, glob, and brace-expansion, which tar 7.1 pulled in through rimraf. tar 7.5 (#1319, #1357) dropped rimraf, so none of those packages are in the dependency tree anymore and the overrides have no effect. Renovate still reads them as declared dependencies and keeps opening PRs to bump them (#1389, #1390, #1392, #1393). @types/tar is unused: npm-distribution has no TypeScript, and tar 7 ships its own types (#1391 would have replaced it with a deprecated stub). Co-authored-by: Amp <[email protected]> Amp-Thread-ID: https://ampcode.com/threads/T-01a1a37e-8603-775d-bc85-c5677817f7a8
marcleblanc2
added a commit
that referenced
this pull request
The overrides block was added in #1218 and #1219 to force patched versions of cross-spawn, glob, and brace-expansion, which tar 7.1 pulled in through rimraf. tar 7.5 (#1319, #1357) dropped rimraf, so none of those packages are in the dependency tree anymore and the overrides have no effect. Renovate still reads them as declared dependencies and keeps opening PRs to bump them (#1389, #1390, #1392, #1393). @types/tar is unused: npm-distribution has no TypeScript, and tar 7 ships its own types (#1391 would have replaced it with a deprecated stub). Co-authored-by: Amp <[email protected]> Amp-Thread-ID: https://ampcode.com/threads/T-01a1a37e-8603-775d-bc85-c5677817f7a8
marcleblanc2
added a commit
that referenced
this pull request
) The overrides block was added in #1218 and #1219 to force patched versions of cross-spawn, glob, and brace-expansion, which tar 7.1 pulled in through rimraf. tar 7.5 (#1319, #1357) dropped rimraf, so none of those packages are in the dependency tree anymore and the overrides have no effect. Renovate still reads them as declared dependencies and keeps opening PRs to bump them (#1389, #1390, #1392, #1393). @types/tar is unused: npm-distribution has no TypeScript, and tar 7 ships its own types (#1391 would have replaced it with a deprecated stub). Amp-Thread-ID: https://ampcode.com/threads/T-01a1a37e-8603-775d-bc85-c5677817f7a8 Co-authored-by: Amp <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
ReviewersUh oh!
There was an error while loading. Please reload this page. AssigneesNo one assignedLabels
None yet
ProjectsMilestoneNo milestoneDevelopmentSuccessfully merging this pull request may close these issues. Uh oh!
There was an error while loading. Please reload this page. 2 participantsAdd this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later. |
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |