Skip to content

Conversation

@danorel
Copy link
Contributor

@danorel danorel commented Jul 14, 2022

Issue: #1007

@kaimallea
Copy link
Contributor

Hey @danorel, thanks for your PR! I will merge after tests pass

@kaimallea
Copy link
Contributor

@danorel ah looks like yarn is expecting an updated yarn.lock; can you run yarn and commit the updated lock? Thanks!

@danorel
Copy link
Contributor Author

danorel commented Jul 14, 2022

@kaimallea I've updated the yarn.lock file and provided a solution with yarn resolutions. Critical security issues with minimist had gone (in packages cz-conventional-changelog and commitizen).

Screenshot 2022-07-14 at 20 46 49

By the way, you can use this approach to resolve other high security issues.

@danorel
Copy link
Contributor Author

danorel commented Jul 14, 2022

Actually, I provided solution, which resolves all security issues.
But surely, the tests should check, whether changes not crashed package compatibility :D

Screenshot 2022-07-14 at 20 55 34

@danorel danorel changed the title fix(web-scripts): resolve sec issue in commitizen, must use ^4.2.4 fix(web-scripts): resolve sec issues Jul 14, 2022
@kaimallea
Copy link
Contributor

Looks good! And makes sense, using resolutions exactly what it was intended for. Thank you for taking the time to contribute this PR!

@kaimallea kaimallea merged commit 5be9fcf into spotify:master Jul 15, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants