Skip to content

fix: dependency vulnerability fixes#1103

Merged
coopernetes merged 8 commits into
finos:mainfrom
jescalada:dependency-vulnerability-fixes
Jul 30, 2025
Merged

fix: dependency vulnerability fixes#1103
coopernetes merged 8 commits into
finos:mainfrom
jescalada:dependency-vulnerability-fixes

Conversation

@jescalada
Copy link
Copy Markdown
Contributor

@jescalada jescalada commented Jul 12, 2025

This PR fixes 4 of the dependency vulnerabilities detected by the OSSF scorecard CI:

score is 0: 23 existing vulnerabilities detected:
Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
Warn: Project is vulnerable to: GHSA-75v8-2h7p-7m2m
Warn: Project is vulnerable to: GHSA-67mh-4wv8-2f99
Warn: Project is vulnerable to: GHSA-859w-5945-r5v3
Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
Warn: Project is vulnerable to: GHSA-f7f6-9jq7-3rqj
Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx
Warn: Project is vulnerable to: GHSA-c7qv-q95q-8v27
Warn: Project is vulnerable to: GHSA-4www-5p9h-95mh
Warn: Project is vulnerable to: GHSA-9gqv-wp59-fq42
Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
Warn: Project is vulnerable to: GHSA-x7hr-w5r2-h6wg
Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p
Warn: Project is vulnerable to: GHSA-4vvj-4cpr-p986
Warn: Project is vulnerable to: GHSA-4v9v-hfq4-rm2v
Warn: Project is vulnerable to: GHSA-9jgg-88mc-972h
Click Remediation section below to solve this issue 

I investigated these one by one and tried to remedy them. 6 of these are actually from our project, the other 17 are coming from the docs website (mostly docusaurus vulnerabilities). Since docusaurus is already at the latest version, it seems they have no intention to fix those up...

Action points

  • Replace docusaurus for another doc generation site
    • This will potentially fix 17 of our vulnerabilities and will likely raise our OSSF score considerably
  • Upgrade Vite from v4 to v5
  • Remove Chai (replace with Jest)

@netlify
Copy link
Copy Markdown

netlify Bot commented Jul 12, 2025

Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Name Link
🔨 Latest commit 6e8e39b
🔍 Latest deploy log https://app.netlify.com/projects/endearing-brigadeiros-63f9d0/deploys/688a2668da9e5f0008d57aa2

@jescalada jescalada self-assigned this Jul 12, 2025
@github-actions github-actions Bot added the fix label Jul 12, 2025
@codecov
Copy link
Copy Markdown

codecov Bot commented Jul 12, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.28%. Comparing base (d4d9239) to head (6e8e39b).
⚠️ Report is 66 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1103      +/-   ##
==========================================
+ Coverage   77.40%   80.28%   +2.87%     
==========================================
  Files          56       59       +3     
  Lines        2288     2475     +187     
  Branches      258      289      +31     
==========================================
+ Hits         1771     1987     +216     
+ Misses        487      453      -34     
- Partials       30       35       +5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@jescalada jescalada marked this pull request as ready for review July 13, 2025 02:33
Copy link
Copy Markdown
Contributor

@coopernetes coopernetes left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this 💪

@coopernetes coopernetes enabled auto-merge (squash) July 30, 2025 13:40
@coopernetes coopernetes merged commit 8e38bd7 into finos:main Jul 30, 2025
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants