8000 [FSSDK-9965] chore: npm audit fix for follow-redirects & get-func-name by mikechu-optimizely · Pull Request #918 · optimizely/javascript-sdk · GitHub
[go: up one dir, main page]
Skip to content

[FSSDK-9965] chore: npm audit fix for follow-redirects & get-func-name #918

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Mar 22, 2024
Merged

[FSSDK-9965] chore: npm audit fix for follow-redirects & get-func-name #918

merged 1 commit into from
Mar 22, 2024

Conversation

mikechu-optimizely
Copy link
Contributor

Summary

  • Fix 2 identified deps CVEs
npm audit
# npm audit report

follow-redirects  <=1.15.5
Severity: moderate
follow-redirects' Proxy-Authorization header kept across hosts - https://github.com/advisories/GHSA-cxjh-pqwp-8mfp
fix available via `npm audit fix`
node_modules/follow-redirects

get-func-name  <2.0.1
Severity: high
Chaijs/get-func-name vulnerable to ReDoS - https://github.com/advisories/GHSA-4q6p-r6v2-jvc5
fix available via `npm audit fix`
node_modules/get-func-name

2 vulnerabilities (1 moderate, 1 high)

Test plan

  • All existing tests should pass

Issues

  • Hijacking FSSDK-9965

@mikechu-optimizely mikechu-optimizely requested a review from a team as a code owner March 22, 2024 14:23
@mikechu-optimizely mikechu-optimizely mentioned this pull request Mar 22, 2024
Closed
pulak-opti
pulak-opti approved these changes Mar 22, 2024
View reviewed changes
Copy link
Contributor
@pulak-opti pulak-opti left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@coveralls
Copy link

Coverage Status

coverage: 90.381%. remained the same
when pulling c287fc6 on mike/FSSDK-9965/dependabot-fixes
into a1e6110 on master.

@mikechu-optimizely mikechu-optimizely merged commit cf941c1 into master Mar 22, 2024
@mikechu-optimizely mikechu-optimizely deleted the mike/FSSDK-9965/dependabot-fixes branch March 22, 2024 14:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@pulak-opti pulak-opti pulak-opti approved these changes

Assignees

@mikechu-optimizely mikechu-optimizely

Labels
chore
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@mikechu-optimizely @coveralls @pulak-opti
0