chore: vulnerability scanning updates #1444
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
iFergal
requested review from
rcmorano
and removed request for
jorgenavben and
sdisalvo-crd
iFergal
commented
Nov 20, 2025
| "web-vitals": "^2.1.4" | ||
| }, | ||
| "devDependencies": { | ||
| "@capacitor/assets": "^3.0.5", |
Collaborator
Author
There was a problem hiding this comment.
@sdisalvo-crd @Sotatek-DukeVu @jorgenavben I'm removing this, and we can instead have whoever is periodically updating the assets to install this globally on their machine - it's not worth including as an additional dependency (which I would like to work on stripping down as we have a mountain of them right now)
iFergal
commented
Nov 20, 2025
| } | ||
| } | ||
| "GHSA-2p57-rm9w-gvfp", // SSRF attacks not relevant to our usage of Meerkat | ||
| "GHSA-4hjh-wcwx-xvwj", // e2e tests |
Collaborator
Author
There was a problem hiding this comment.
I intend on re-evaluating some of these properly in case they pose some risk, even if a dev dependency. But I think it's easier to just blanket update appium and all related e2e dependencies tomorrow.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
audit-ciwas only complaining about critical vulnerabilities but I would rather know about them all and ignore on a case-by-case basis. I will be re-evaluating the e2e test ones a bit closer later, as I think many of them can go away by bumping the appium server and related deps.