Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove ember-auto-import 1.12.1 DependencyTrack #11730

Closed
gabrieltrita opened this issue Apr 22, 2024 · 2 comments · Fixed by #11753
Closed

Remove ember-auto-import 1.12.1 DependencyTrack #11730

gabrieltrita opened this issue Apr 22, 2024 · 2 comments · Fixed by #11753
Labels
Package: ember Type: Improvement

Comments

@gabrieltrita
Copy link

Problem Statement

A security issue was detected in versions of ember-auto-import lower than 1.12.2, as it uses babel-traverse:6.26.0, would it be possible to remove the dependency on ember-auto-import 1.12.1?

Refs:

GHSA-67hx-6x53-jw92

Dependency Tree

→ ember-auto-import:1.12.2
→ ember-cli-babel:6.18.0
→ broccoli-babel-transpiler:6.5.1
→ babel-core:6.26.3
→ babel-traverse:6.26.0

Solution Brainstorm

Remove ember-auto-import 1.12.1:
https://github.com/getsentry/sentry-javascript/blob/d2d2e0af05bd1ab2a3b296ad3ebb976285775193/packages/ember/package.json#L39C5-L39C46
@AbhiPrasad
Copy link
Member

@gabrieltrita I don't think this security warning is accurate because ember-auto-import only is used in development, nothing should be exposed in production.

Could you pin babel-traverse via a custom resolution to a higher version to get around this?

@mydea is it a good idea to drop ember-auto-import v1 for v8?

@mydea
Copy link
Member

mydea commented Apr 23, 2024

I think we can at the very least we can bump to 1.12.2. We could also think to drop 1.x overall (we are already in beta but I think this wouldn't be too bad to do still...)

@mydea mydea mentioned this issue Apr 23, 2024
Merged
mydea added a commit that referenced this issue Apr 30, 2024
@mydea
feat(ember): Update ember dependencies (#11753)
064c5ae 
This updates the versions of some dependencies for the Ember SDK:

* `ember-auto-import` is bumped to `^2.4.3`
* `ember-cli-babel` is bumped to `^8.2.0`
* `ember-cli-typescript` is bumped to `^5.3.0`

Closes #11730
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Package: ember Type: Improvement
Projects
GitHub Issues with 👀 2
Archived in project
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat(ember): Update ember dependencies getsentry/sentry-javascript
3 participants
@gabrieltrita @mydea @AbhiPrasad