Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Resolves Issue 262 - CVE-2023-45133 - upgrade to latest babel traverse #266

Merged
merged 1 commit into from Oct 23, 2023
Merged

Resolves Issue 262 - CVE-2023-45133 - upgrade to latest babel traverse #266

merged 1 commit into from Oct 23, 2023

Conversation

c-h-russell-walker
Copy link
Contributor

@c-h-russell-walker c-h-russell-walker commented Oct 22, 2023 •
edited

This PR resolves this issue:
#262

The issue mentioned is that there a security warning issued for @babel/traverse package seen here:
https://security.snyk.io/vuln/SNYK-JS-BABELTRAVERSE-5962462

To create this PR I:

  • forked repo
  • cloned locally
  • updated package.json to be latest version of @babel/traverse
  • ran yarn
  • committed changes

Please let me know if there's anything I else can/need to do - like run tests etc. - thanks!

Updating to add that yarn type-check and yarn test pass as expected locally:

Screenshot 2023-10-22 at 7 27 27 PM

@c-h-russell-walker c-h-russell-walker mentioned this pull request Oct 22, 2023
Closed
@harryzcy harryzcy mentioned this pull request Oct 23, 2023
Open
@byara byara requested review from ayusharma and byara October 23, 2023 06:40
byara
byara approved these changes Oct 23, 2023
View reviewed changes
Copy link
Collaborator

@byara byara left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for you contribution 🚀
We'll release this as soon as possible.

@ayusharma ayusharma merged commit 4f328cf into trivago:main Oct 23, 2023
3 checks passed
@c-h-russell-walker
Copy link
Contributor Author

Thank you for you contribution 🚀

We'll release this as soon as possible.

Thanks so much for the quick release!

This was referenced Oct 24, 2023
Merged
Merged
@sparrowt
Copy link

sparrowt commented Dec 7, 2023

Out of interest, why does this have to pin a specific version of @babel/traverse rather than using ^ or ~ to be more flexible?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@byara byara byara approved these changes

@ayusharma ayusharma Awaiting requested review from ayusharma

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@c-h-russell-walker @sparrowt @byara @ayusharma