Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update npm packages #409

Merged
merged 5 commits into from
May 23, 2024
Merged

update npm packages #409

merged 5 commits into from
May 23, 2024

Conversation

nlsvgtr
Copy link
Contributor

@nlsvgtr nlsvgtr commented May 2, 2024

  • update npm packages
  • remove unused packages
  • remove unused services

Critical issues have been solved. I propose to merge these fixes, and solve the rest later.

High risk issues remain in two packages:

  • image-steam uses a vulnerable version of sharp; it can be easily updated. A PR is created; if the maintainer does not respond, we could fork the lib for now.
  • mjml uses html-minifier which is no longer maintained. This will not be solved until the next major version of mjml, We may need to replace mjml. See High Severity Vulnerability in html-minifier mjmlio/mjml#2589

After that only three moderate warnings remain, due to a dependency in @kubernetes/client-node

@nlsvgtr nlsvgtr marked this pull request as ready for review May 13, 2024 13:14
@nlsvgtr
Copy link
Contributor Author

nlsvgtr commented May 21, 2024

The image-steam PR has been merged (though not published, so we're using a github link now).

All remaining high risk issues are due to MJML.

Copy link
Contributor

@rudivanhierden rudivanhierden left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bedankt voor het uitzoeken! 💪

@nlsvgtr nlsvgtr merged commit 6ad5d28 into main May 23, 2024
5 checks passed
@nlsvgtr nlsvgtr deleted the fix/security-updates branch May 23, 2024 08:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants