update pacakge dependencies

solves security advisory https://www.npmjs.com/advisories/1623

Package           Current  Wanted   Latest  Location                       Depended by
@esm-bundle/chai    4.1.5   4.3.0    4.3.0  node_modules/@esm-bundle/chai  once
@web/test-runner   0.9.13  0.9.13  0.12.15  node_modules/@web/test-runner  once
eslint             7.18.0  7.21.0   7.21.0  node_modules/eslint            once
rollup             2.38.1  2.40.0   2.40.0  node_modules/rollup            once

Issue fork once-3201161

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

nod_ created an issue. See original summary.

nod_ opened merge request !15

nod_’s picture

nod_
Primary language French
Location Lille
commented
Issue summary: View changes
Status: Active » Needs review
justafish’s picture

justafish
she/her
Primary language English
Location London, UK
commented
Status: Needs review » Reviewed & tested by the community

+1

nod_’s picture

nod_
Primary language French
Location Lille
commented
Status: Reviewed & tested by the community » Fixed
justafish’s picture

justafish
she/her
Primary language English
Location London, UK
commented
Status: Fixed » Needs review

I'm still seeing vulnerabilities reported at https://git.drupalcode.org/project/once/-/security/vulnerability_report

nod_’s picture

nod_
Primary language French
Location Lille
commented

umm we don't seem to need @esm-bundle/chai, so that's one down

nod_ opened merge request !19

nod_’s picture

nod_
Primary language French
Location Lille
commented

seems to do the trick https://git.drupalcode.org/project/once/-/pipelines/127/security

nod_’s picture

nod_
Primary language French
Location Lille
commented

alerts still things showing up on the report https://git.drupalcode.org/project/once/-/security/vulnerability_report but everything is up to date (on our side) might need to contribute upstream but I don't think we can do much more from here.

justafish’s picture

justafish
she/her
Primary language English
Location London, UK
commented
Status: Needs review » Fixed

The report is clear now

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.