Bug/Vulnerability Fixes

- Addressed fast-xml-parser and ws vulnerability issues - Added AWS credentials Signed-off-by: Harold Wanyama <[email protected]>
communitybridge · Aug 10, 2024 · ef9f42a · ef9f42a
1 parent a0b3289
commit ef9f42a
Show file tree

Hide file tree

Showing 5 changed files with 28 additions and 27 deletions.
diff --git a/.github/workflows/build-pr.yml b/.github/workflows/build-pr.yml
@@ -8,11 +8,13 @@ on:
     branches:
       - main
 
+
 env:
+  AWS_REGION: us-east-1
   STAGE: dev
 
 jobs:
-  build-pr:
+  build-deploy-dev:
     runs-on: ubuntu-latest
     environment: dev
     steps:
@@ -36,7 +38,7 @@ jobs:
         uses: actions/cache@v2
         with:
           path: ${{ github.workspace }}/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-${{ github.run_id }}
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
           restore-keys: |
             ${{ runner.os }}-go-
 
@@ -78,10 +80,7 @@ jobs:
 
       - name: Go Dependencies
         working-directory: cla-backend-go
-        run: |
-          go mod tidy
-          go mod download
-          make deps
+        run: make deps
 
       - name: Go Swagger Generate
         working-directory: cla-backend-go
@@ -100,4 +99,4 @@ jobs:
 
       - name: Go Lint
         working-directory: cla-backend-go
-        run: make lint
+        run: make lint
diff --git a/cla-backend-go/package.json b/cla-backend-go/package.json
@@ -45,7 +45,8 @@
     "qs": "^6.11.0",
     "set-value": "^4.0.1",
     "simple-git": "^3.16.0",
-    "ws": "^7.4.6",
-    "xmlhttprequest-ssl": "^1.6.2"
+    "ws": ">=7.5.10",
+    "xmlhttprequest-ssl": "^1.6.2",
+    "fast-xml-parser": ">=4.4.1"
   }
 }
diff --git a/cla-backend-go/yarn.lock b/cla-backend-go/yarn.lock
@@ -2903,10 +2903,10 @@ fast-safe-stringify@^2.1.1:
   resolved "https://registry.yarnpkg.com/fast-safe-stringify/-/fast-safe-stringify-2.1.1.tgz#c406a83b6e70d9e35ce3b30a81141df30aeba884"
   integrity sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==
 
-[email protected]:
-  version "4.2.5"
-  resolved "https://registry.yarnpkg.com/fast-xml-parser/-/fast-xml-parser-4.2.5.tgz#a6747a09296a6cb34f2ae634019bf1738f3b421f"
-  integrity sha512-B9/wizE4WngqQftFPmdaMYlXoJlJOYxGQOanC77fq9k8+Z0v5dDSVh+3glErdIROP//s/jgb7ZuxKfB8nVyo0g==
+[email protected], fast-xml-parser@>=4.4.1:
+  version "4.4.1"
+  resolved "https://registry.yarnpkg.com/fast-xml-parser/-/fast-xml-parser-4.4.1.tgz#86dbf3f18edf8739326447bcaac31b4ae7f6514f"
+  integrity sha512-xkjOecfnKGkSsOwtZ5Pz7Us/T6mrbPQrq0nh+aCO5V9nk5NLWmasAHumTKjiPJPWANe+kAZ84Jc8ooJkzZ88Sw==
   dependencies:
     strnum "^1.0.5"
 
@@ -5448,10 +5448,10 @@ write-file-atomic@^4.0.2:
     imurmurhash "^0.1.4"
     signal-exit "^3.0.7"
 
-ws@^7.4.6, ws@^7.5.3, ws@^7.5.9:
-  version "7.5.9"
-  resolved "https://registry.yarnpkg.com/ws/-/ws-7.5.9.tgz#54fa7db29f4c7cec68b1ddd3a89de099942bb591"
-  integrity sha512-F+P9Jil7UiSKSkppIiD94dN07AwvFixvLIj1Og1Rl9GGMuNipJnV9JzjD6XuqmAeiswGvUmNLjr5cFuXwNS77Q==
+ws@>=7.5.10, ws@^7.5.3, ws@^7.5.9:
+  version "8.18.0"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-8.18.0.tgz#0d7505a6eafe2b0e712d232b42279f53bc289bbc"
+  integrity sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw==
 
 [email protected]:
   version "0.6.2"

diff --git a/cla-backend/package.json b/cla-backend/package.json
@@ -66,7 +66,8 @@
     "set-value": "^4.0.1",
     "shell-quote": "^1.7.3",
     "simple-git": "^3.16.0",
-    "ws": "^7.4.6",
-    "xmlhttprequest-ssl": "^1.6.2"
+    "ws": ">=7.5.10",
+    "xmlhttprequest-ssl": "^1.6.2",
+    "fast-xml-parser": ">=4.4.1"
   }
 }
diff --git a/cla-backend/yarn.lock b/cla-backend/yarn.lock
@@ -2742,10 +2742,10 @@ fast-glob@^3.2.7, fast-glob@^3.2.9, fast-glob@^3.3.1:
     merge2 "^1.3.0"
     micromatch "^4.0.4"
 
-[email protected]:
-  version "4.2.5"
-  resolved "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-4.2.5.tgz"
-  integrity sha512-B9/wizE4WngqQftFPmdaMYlXoJlJOYxGQOanC77fq9k8+Z0v5dDSVh+3glErdIROP//s/jgb7ZuxKfB8nVyo0g==
+[email protected], fast-xml-parser@>=4.4.1:
+  version "4.4.1"
+  resolved "https://registry.yarnpkg.com/fast-xml-parser/-/fast-xml-parser-4.4.1.tgz#86dbf3f18edf8739326447bcaac31b4ae7f6514f"
+  integrity sha512-xkjOecfnKGkSsOwtZ5Pz7Us/T6mrbPQrq0nh+aCO5V9nk5NLWmasAHumTKjiPJPWANe+kAZ84Jc8ooJkzZ88Sw==
   dependencies:
     strnum "^1.0.5"
 
@@ -5006,10 +5006,10 @@ write-file-atomic@^4.0.2:
     imurmurhash "^0.1.4"
     signal-exit "^3.0.7"
 
-ws@^7.4.6, ws@^7.5.3, ws@^7.5.9:
-  version "7.5.9"
-  resolved "https://registry.yarnpkg.com/ws/-/ws-7.5.9.tgz#54fa7db29f4c7cec68b1ddd3a89de099942bb591"
-  integrity sha512-F+P9Jil7UiSKSkppIiD94dN07AwvFixvLIj1Og1Rl9GGMuNipJnV9JzjD6XuqmAeiswGvUmNLjr5cFuXwNS77Q==
+ws@>=7.5.10, ws@^7.5.3, ws@^7.5.9:
+  version "8.18.0"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-8.18.0.tgz#0d7505a6eafe2b0e712d232b42279f53bc289bbc"
+  integrity sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw==
 
 [email protected]:
   version "0.6.2"