Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: update npm audit ignore list #2357

Merged
merged 2 commits into from
Nov 23, 2021

Conversation

rpl
Copy link
Member

@rpl rpl commented Nov 23, 2021

All CI jobs are currently failing on the "npm audit" step, due to a json-schema advisory introduced by request npm package through transitive dependencies originated by:

  • addons-linter 3.23.0 through dispensary (which is actually already fixed in addons-linter >= 4.1.0 where the dispensary dependency has been merged into addons-linter project and request npm package replaced by node-fetch)
  • sign-addon (which does currently use request as one of its direct dependencies)

This PR includes the following changes:

  • Removed from audit ignore list old trim-off-newlines advisories.
  • Added json-schema advisory to npm audit ignore list

This PR is mainly meant to allow us to unblock the CI jobs in the short run (and in particular to allow #2350 to pass all CI jobs and get rid of one of the two dependencies that are currently introducing a transitive dependency for the request package), but we also follow up to remove from the ignore list at least the advisories that are related to non-"dev-only" dependencies:

@codecov
Copy link

codecov bot commented Nov 23, 2021

Codecov Report

Merging #2357 (c87a136) into master (72d7e90) will not change coverage.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##           master    #2357   +/-   ##
=======================================
  Coverage   99.88%   99.88%           
=======================================
  Files          32       32           
  Lines        1700     1700           
=======================================
  Hits         1698     1698           
  Misses          2        2           

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 72d7e90...c87a136. Read the comment docs.

@rpl rpl merged commit e702dc9 into mozilla:master Nov 23, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant