Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: Update npm packages #2376

Merged
merged 7 commits into from
Jul 18, 2023
Merged

chore: Update npm packages #2376

merged 7 commits into from
Jul 18, 2023

Conversation

ianlewis
Copy link
Member

@ianlewis ianlewis commented Jul 12, 2023 •
edited
Loading

Updates npm packages to resolves vulnerabilities with the semver and word-wrap packages.

Update npm packages
24263a9 
Signed-off-by: Ian Lewis <ianlewis@google.com>
@ianlewis
Copy link
Member Author

hmm, not sure why it's failing to install tscommon. It works for me locally.

make[1]: Leaving directory '/home/runner/work/slsa-github-generator/slsa-github-generator/.github/actions/detect-workflow-js'
make[1]: Entering directory '/home/runner/work/slsa-github-generator/slsa-github-generator/.github/actions/verify-token'
npm ci
npm WARN tarball tarball data for tscommon@file:/home/runner/work/slsa-github-generator/slsa-github-generator/.github/actions/tscommon/tscommon-0.0.0.tgz (sha512-28y7jGsMkhFBkER+m9nbxmboXX7AxM0K7eBHQnf5M/GAj+U+Ojs5DR8AxREWofEQ0bu75TcON9QPLU3uq+dEFQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for tscommon@file:/home/runner/work/slsa-github-generator/slsa-github-generator/.github/actions/tscommon/tscommon-0.0.0.tgz (sha512-28y7jGsMkhFBkER+m9nbxmboXX7AxM0K7eBHQnf5M/GAj+U+Ojs5DR8AxREWofEQ0bu75TcON9QPLU3uq+dEFQ==) seems to be corrupted. Trying again.
npm ERR! code EINTEGRITY
npm ERR! sha512-28y7jGsMkhFBkER+m9nbxmboXX7AxM0K7eBHQnf5M/GAj+U+Ojs5DR8AxREWofEQ0bu[75](https://github.com/slsa-framework/slsa-github-generator/actions/runs/5528845673/jobs/10086119544?pr=2376#step:5:76)TcON9QPLU3uq+dEFQ== integrity checksum failed when using sha512: wanted sha512-28y7jGsMkhFBkER+m9nbxmboXX7AxM0K7eBHQnf5M/GAj+U+Ojs5DR8AxREWofEQ0bu75TcON9QPLU3uq+dEFQ== but got sha512-GOJnxUDlyquHeLZf18+LGqwihUHnkKhuHwHIWDP9DCTYAgo5ZPXM77PbHsmF/avEjmofZUzExU7EXL2iCzOTcg==. (3543 bytes)

Ian Lewis added 2 commits July 12, 2023 23:58
Install newer npm
c2aa4d0 
Signed-off-by: Ian Lewis <ianlewis@google.com>
Update package lock
f994d6c 
Signed-off-by: Ian Lewis <ianlewis@google.com>
@ianlewis
Copy link
Member Author

hmm, not sure why it's failing to install tscommon. It works for me locally.

It seems you need to delete your local npm cache using npm cache clean --force in order to reproduce. I think npm uses the old cache since the tscommon-0.0.0.tgz name doesn't change.

Ian Lewis added 3 commits July 13, 2023 00:25
Update tscommon
1733e1a 
Signed-off-by: Ian Lewis <ianlewis@google.com>
Update tscommon
c09691d 
Signed-off-by: Ian Lewis <ianlewis@google.com>
Update
4565313 
Signed-off-by: Ian Lewis <ianlewis@google.com>
@ianlewis ianlewis mentioned this pull request Jul 13, 2023
Merged
@ianlewis ianlewis enabled auto-merge (squash) July 18, 2023 01:42
@ianlewis ianlewis merged commit 28c1aba into slsa-framework:main Jul 18, 2023
enteraga6 pushed a commit to enteraga6/slsa-github-generator that referenced this pull request Aug 8, 2023
@enteraga6
chore: Update npm packages (slsa-framework#2376)
4850315 
Updates npm packages to resolves vulnerabilities with the `semver` and
`word-wrap` packages.

---------

Signed-off-by: Ian Lewis <ianlewis@google.com>
Signed-off-by: Noah Elzner <elzner@google.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@laurentsimon laurentsimon laurentsimon approved these changes

@asraa asraa Awaiting requested review from asraa

@joshuagl joshuagl Awaiting requested review from joshuagl joshuagl is a code owner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@ianlewis @laurentsimon