Find and fix vulnerable npm packages #8
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
timtebeek
commented
Aug 3, 2024
|
If we want to reduce the duplication, I've now made the ecosystem of the GitHub security advisory database configurable in We could then push that file here from that repository, as we also do with a few other deploy keys such as for our docs. |
shanman190
reviewed
Aug 4, 2024
src/main/java/org/openrewrite/nodejs/github/ParseAdvisories.java
Outdated
Show resolved
Hide resolved
timtebeek
commented
Aug 4, 2024
src/main/java/org/openrewrite/nodejs/github/ParseAdvisories.java
Outdated
Show resolved
Hide resolved
Co-authored-by: Shannon Pamperl <[email protected]>
timtebeek
commented
Aug 4, 2024
src/main/java/org/openrewrite/nodejs/github/ParseAdvisories.java
Outdated
Show resolved
Hide resolved
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
src/main/java/org/openrewrite/nodejs/DependencyVulnerabilityCheck.java
Outdated
Show resolved
Hide resolved
src/test/java/org/openrewrite/nodejs/DependencyVulnerabilityCheckTest.java
Outdated
Show resolved
Hide resolved
src/main/java/org/openrewrite/nodejs/DependencyVulnerabilityCheck.java
Outdated
Show resolved
Hide resolved
src/test/java/org/openrewrite/nodejs/DependencyVulnerabilityCheckTest.java
Outdated
Show resolved
Hide resolved
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
pstreef
approved these changes
Aug 4, 2024
src/main/java/org/openrewrite/nodejs/github/advisories/Advisory.java
Outdated
Show resolved
Hide resolved
src/main/java/org/openrewrite/nodejs/github/advisories/Range.java
Outdated
Show resolved
Hide resolved
src/main/java/org/openrewrite/nodejs/github/advisories/Range.java
Outdated
Show resolved
Hide resolved
kmccarp
pushed a commit
to kmccarp/rewrite-nodejs
that referenced
this pull request
Aug 22, 2024
* Parse vulnerabilities into local csv file * Detect and bump NPM dependency versions * Some minor comments to document what's done * Parse a single advisory file in tests due to ordering * Additional tests to document current behavior * Find all vulnerabilities, but only bump patch versions * Minor polish to get rid of warnings * Apply suggestions from code review Co-authored-by: Shannon Pamperl <[email protected]> * Apply suggestions from code review * Apply suggestions from code review Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Keep parsing advisories in rewrite-java-dependencies --------- Co-authored-by: Shannon Pamperl <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What's changed?
Add a recipe to Find and fix vulnerable npm packages
Anything in particular you'd like reviewers to focus on?
^versions specifically..minorand.majorCVEs in code that now only show up in data table rowsDependencyInsightthis for now assumes a singlepackage-lock.json. Should we support multiple?Anyone you would like to review specifically?
@zieka
Have you considered any alternatives or workarounds?
rewrite-java-dependencies, unless we rename thatrewrite-dependencies.DependencyVulnerabilityCheckfor Java, producing different data table rows sans groupId/artifactId split, and without dependency depth, due to lacking data. This will require new visualizations, and separate recipe runs, but seemed a stretch to "make it fit" the existing model in rewrite-java-dependencies.