Update package.json

[warpech]

For reasons enclosed on Slack: https://starcounter.slack.com/archives/C7677F70W/p1524776857000399

[warpech]

Same alert appears in

• https://github.com/Starcounter/starcounter-layout-html-editor
• https://github.com/Starcounter/Blending
• https://github.com/Starcounter/starcounter-include
• https://github.com/Juicy/juicy-popover
• Perhaps few more Juicy and Palindrom repos?

[alshakero]

It will appear wherever Polymer 2.0 appears.

[alshakero]

Closing as it's a false flag, see request/request#2926 (comment)

Extra assurance from a GH staffer: hapijs/hoek#247 (comment)

[alshakero]

Reopening as 2.16.3 is indeed infected. The false flag was for 4.2.1.

[warpech]

This is not urgent, moving to July.

[warpech]

Web Components Tester 6.7.0 was released this week. I suppose it might fix the vulnerabilities alerts: https://github.com/Polymer/tools/releases/tag/web-component-tester%406.7.0

Edit: it might not be enough, given this PR that was started afterwards: Polymer/tools#533

[alshakero]

Polymer/tools#533 is still WIP

[warpech]

Meanwhile, I can see that some of our vulnerabilities actually don't depend on it:

• the vulnerability in https://github.com/Palindrom/Palindrom seems to be in our control by upgrading Mocha to the current version

[alshakero]

the vulnerability in Palindrom/Palindrom seems to be in our control by upgrading Mocha to the current version

PR in Palindrom/Palindrom#213

[warpech]

There is a general solution that should be applied in all affected repos that have web-component-tester in package.json: Starcounter/starcounter-include#106

@alshakero could you pls apply it in all relevant repos?

[warpech]

What's the status of this?

[alshakero]

It is blocked by this Palindrom/Palindrom#213

[warpech]

Meanwhile, can you look at other custom element repos, such as https://github.com/Starcounter/starcounter-layout-html-editor?

[alshakero]

https://github.com/Starcounter/starcounter-layout-html-editor is fixed.

[alshakero]

Closing as finally done. I think all security warnings are fixed at this point except Blending's one which should be fixed here https://github.com/Starcounter/Blending/pull/277.

Are you aware of any other security warnings?

[warpech]

Do you have "Vulnerability alerts" subscribed on the page https://github.com/settings/notifications?

Every day I get a daily digest with the repos that still have vulnerabilities. Today's report includes:

• https://github.com/Palindrom/puppetjs.github.io
• https://github.com/Palindrom/palindrom.github.io
• https://github.com/Juicy/juicy.github.io
• https://github.com/Starcounter/SignIn - this can be fixed by @Mihaiii if you say how to fix that
• https://github.com/Starcounter/People - this can be fixed by @Mihaiii if you say how to fix that
• https://github.com/Starcounter/Blending - this can be fixed by @PatrykSzwer if you say how to fix that

[alshakero]

Do you have "Vulnerability alerts" subscribed on the page github.com/settings/notifications?

Now I do.

Blending should be fixed by this PR https://github.com/Starcounter/Blending/pull/277

[alshakero]

1. Palindrom/puppetjs.github.io, I archived the repo.
2. Palindrom/palindrom.github.io, Fixed
3. Juicy/juicy.github.io, working on it. Fixed.
4. Starcounter/SignIn, tracked here Fixed.
5. Starcounter/People, PR here. Fixed.
6. Starcounter/Blending PR here. Fixed.

[alshakero]

Closing as all fixed.

[warpech]

Huge victory! Thanks everyone involved