[Snyk] Fix for 2 vulnerabilities #10408
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-LODASH-15053838 - https://snyk.io/vuln/SNYK-JS-LODASHES-15053836
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
⛔ Snyk checks have failed. 1 issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
WalkthroughChangesSequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant Dev as Developer
participant PM as Package Manager
participant GH as github-issues Plugin
participant CC as @backstage/core-components
participant INT as @backstage/integration
participant PCR as @backstage/plugin-catalog-react
Dev->>PM: Install dependencies for github-issues
PM->>GH: Read package.json
Note over GH,PCR: Dependency Resolution Changes
alt Before: workspace:^ protocol
PM->>PM: Resolve from local workspace
Note over PM: Uses local monorepo versions
else After: Fixed versions
PM->>CC: Fetch @backstage/core-components@0.1.0
CC-->>PM: Return package
PM->>INT: Fetch @backstage/integration@0.1.0
INT-->>PM: Return package
PM->>PCR: Fetch @backstage/plugin-catalog-react@0.0.1
PCR-->>PM: Return package
Note over PM: Uses specific published versions
end
PM->>GH: Install resolved dependencies
PM-->>Dev: Installation complete
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
Snyk has created this PR to fix 2 vulnerabilities in the yarn dependencies of this project.
Snyk changed the following file(s):
plugins/github-issues/package.jsonNote for zero-installs users
If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the
.yarn/cache/directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to runyarnto update the contents of the./yarn/cachedirectory.If you are not using zero-install you can ignore this as your flow should likely be unchanged.
Vulnerabilities that will be fixed with an upgrade:
SNYK-JS-LODASH-15053838
SNYK-JS-LODASHES-15053836
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Prototype Pollution