Upgrade JS lock files to exclude insecure deps #221
Conversation
pvditto
requested review from
kristopherjohnson and
teodorciuraru
as code owners
pvditto
changed the title
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
Files not reviewed (3)
- javascript-tui/package-lock.json: Language not supported
- javascript-web/package-lock.json: Language not supported
- react-native-expo/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
teodorciuraru
left a comment
teodorciuraru
left a comment
There was a problem hiding this comment.
How do we ensure that when we remove locks, we don't reintroduce the vulnerabilities? Don't we need resolution {} blocks for the package.json's and NPM equivalents too?
|
@teodorciuraru the vulnerabilities only existed in the lock files, installing deps without lock files would not reintroduce them because our direct dependencies don't restrict these transitive dependencies to vulnerable versions. If that was not the case we would see resolution fail when bumping the lock file version of the affected packages. Overrides/resolutions are only needed when you want to forcibly override a dependency's explicit requirement for a vulnerable version Generally, I would not delete lock files ever to recreate them, unless absolutely necessary. And if that is done, NPM always audits resolved dependencies and displays a warning when any of the installed versions have known vulnerabilities. This warning should never be ignored by us, and will also create a dependabot alert when merged. |
Resolves vulnerabilities.