Skip to content

Fix all security vulnerabilities in dependencies #300

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
neil-armstrong-instil merged 6 commits into from
Nov 10, 2025
Merged

Fix all security vulnerabilities in dependencies #300

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
4b3afe9
Initial plan
Copilot Nov 10, 2025
9f8fdcf
Fix all security warnings by upgrading dependencies
Copilot Nov 10, 2025
6cba278
Upgrade devDependencies directly instead of using resolutions
Copilot Nov 10, 2025
9011b16
Remove all unnecessary resolutions by upgrading packages
Copilot Nov 10, 2025
2151f22
Replace dependency-overrides.md with resolutionsComments in package.json
Copilot Nov 10, 2025
72d41e5
Update Node version to 20.9.0 to support upgraded dependencies
Copilot Nov 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .node-version
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
16.5.0
20.9.0
12 changes: 0 additions & 12 deletions dependency-overrides.md
View file
Open in desktop

This file was deleted.

30 changes: 15 additions & 15 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,38 +44,38 @@
"deployed-package:sync:icons": "yarn figma-sync:withIcons"
},
"dependencies": {
"axios": "1.6.0",
"axios": "1.13.2",
"figma-api": "1.11.0",
"lodash": "4.17.21",
"require-from-string": "2.0.2",
"sd-tailwindcss-transformer": "1.4.6",
"style-dictionary": "3.9.0",
"style-dictionary": "3.9.2",
"typescript": "5.2.2"
},
"devDependencies": {
"@instil/figma-sync": "6.0.0",
"@types/jest": "29.5.7",
"@types/jest": "30.0.0",
"@types/lodash": "4.14.200",
"@types/node": "20.8.10",
"@types/require-from-string": "1.2.2",
"@typescript-eslint/eslint-plugin": "6.9.1",
"@typescript-eslint/parser": "6.9.1",
"eslint": "8.52.0",
"eslint-plugin-import": "2.29.0",
"eslint-plugin-jest": "27.6.0",
"@typescript-eslint/eslint-plugin": "8.46.4",
"@typescript-eslint/parser": "8.46.4",
"eslint": "8.57.1",
"eslint-plugin-import": "2.32.0",
"eslint-plugin-jest": "28.10.0",
"eslint-plugin-no-relative-import-paths": "1.5.3",
"jest": "29.7.0",
"jest": "30.2.0",
"npm-pack-all": "1.12.7",
"ts-jest": "29.1.1",
"ts-jest": "29.4.5",
"ts-node": "10.9.1",
"ts-patch": "3.0.2",
"ts-patch": "3.3.0",
"tsconfig-paths": "4.2.0",
"typescript-transform-paths": "3.4.6"
},
"resolutions": {
"@babel/traverse": "7.23.2",
"http-cache-semantics": "4.1.1",
"json5": "2.2.3",
"semver": "7.5.4"
"axios": "1.13.2"
Copy link
Collaborator

@neil-armstrong-instil neil-armstrong-instil Nov 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot why is this resolution still required?

Copy link
Contributor Author

Copilot AI Nov 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The axios resolution is needed because figma-api@1.11.0 depends on axios: ^0.21.1, which resolves to the vulnerable version 0.21.4.

The latest stable version of figma-api (1.12.0) still uses axios: ^0.27.2 (also vulnerable). The beta version (2.1.0-beta) uses axios: ^1.12.2, but it's a major rewrite with breaking API changes.

Without this resolution, the vulnerable axios 0.21.4 would be installed for figma-api, failing the security audit. The resolution ensures all axios dependencies use the secure 1.13.2 version.

Copy link
Collaborator

@neil-armstrong-instil neil-armstrong-instil Nov 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot can you delete the dependecy-override.md file, and then instead add a ```
"resolutionsComments": {
"axios": "some explaination here"
}

That explains this in a single short sentence?

Copy link
Contributor Author

Copilot AI Nov 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Deleted dependency-overrides.md and added resolutionsComments field to package.json with a concise explanation. (2151f22)

},
"resolutionsComments": {
"axios": "figma-api@1.11.0 depends on vulnerable axios@^0.21.1; resolution ensures all dependencies use secure version"
}
}
Loading