Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: bump dependencies to fix vulnerability #416

Merged
merged 1 commit into from
Oct 20, 2023

Conversation

Justintime50
Copy link
Member

@Justintime50 Justintime50 commented Oct 20, 2023

Description

Fixes https://github.com/EasyPost/easypost-node/security/dependabot/52

Testing

Pull Request Type

Please select the option(s) that are relevant to this PR.

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Improvement (fixing a typo, updating readme, renaming a variable name, etc)

@Justintime50 Justintime50 requested a review from a team October 20, 2023 16:57
@nwithan8
Copy link
Member

No changes committed to packages.json, just the lock file?

@Justintime50
Copy link
Member Author

Justintime50 commented Oct 20, 2023

No changes committed to packages.json, just the lock file?

Correct, the dependency with a vulnerability is a dep of a dep. We can't manipulate anything in package.json to fix that. A quick npm update bumps everything to the most recent versions that respect our pinned ranges, simultaneously bumping the vulnerable dep to what is required to use the fix.

@nwithan8 nwithan8 self-requested a review October 20, 2023 17:13
@nwithan8 nwithan8 merged commit bb218d7 into master Oct 20, 2023
6 checks passed
@nwithan8 nwithan8 deleted the babel_traverse_dep_bump branch October 20, 2023 17:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants