Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update packages with security vulnerabilities #21

Open
garg3133 opened this issue Feb 23, 2024 · 4 comments
Open

Update packages with security vulnerabilities #21

garg3133 opened this issue Feb 23, 2024 · 4 comments
Labels
good first issue Good for newcomers

Comments

@garg3133
Copy link
Member

If you set up this project locally (fork, clone and then run npm i) and do npm audit, you'll see that a lot of packages that this project is dependent on have security vulnerabilities in them.

image

So, we'd need to update the packages iteratively to handle these security vulnerabilities while also making sure that upgrading to newer versions don't end up breaking the tool in some way or another.

@garg3133 garg3133 added the good first issue Good for newcomers label Feb 23, 2024
@AkhilJ321
Copy link

@garg3133, for low severity fixes which will not break the code can be done by npm audit fix , then for the remaining do we need to do them manually and check for compatibility, or implement some kind of script or automated testing?

@garg3133
Copy link
Member Author

I'd suggest doing them manually to ensure compatibility. But you can work on these iteratively, first fix the easier ones and open a PR and then iterate over the more severe ones and open a PR as you go from one consistent state to another.

@AkhilJ321
Copy link

@garg3133 ,can you review the PR and check if I am going in the right direction?

@AkhilJ321 AkhilJ321 mentioned this issue Mar 6, 2024
@adilkadivala
Copy link

hey, I think this issue is not solved yet, if yes then please assign me it, I wanna counter it..

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
good first issue Good for newcomers
Projects
None yet
Development

No branches or pull requests

3 participants