Skip to content

Commit b6fb016

Browse files
committed
chore(deps): Get audit-filter working for all packages in monorepo
* Add a lint:deps job to the top-level package.json, so lerna can run lint:deps in all packages in parallel. * Also fix today's handlebars vulnerability, so that builds don't fail. Some of the vulnerabilities are in transitive dependencies, yet the suggested `npm update foo --depth N` command sometimes seems to do nothing. There was a related bug in npm 6.6.0 - 6.11.2, fixed by npm/cli#239, but perhaps that didn't fix all the cases? (I was using npm 6.12.0.) As a workaround, I've added audit-filter exceptions where `npm update` wasn't able to fix vulnerabilities. Fixes #2229.
1 parent 7c08e5a commit b6fb016

File tree

21 files changed

+2165
-107
lines changed

21 files changed

+2165
-107
lines changed

package.json

+1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
"authors": "git shortlog -s | cut -c8- | sort -f > AUTHORS",
77
"postinstall": "_scripts/install_all.sh",
88
"npm-ci-all": "lerna exec --parallel -- npm ci",
9+
"lint:deps": "lerna exec --parallel -- npm run lint:deps",
910
"start": "pm2 start mysql_servers.json && echo \"Use 'npm stop' to stop all the servers\"",
1011
"stop": "pm2 kill",
1112
"start-firefox": "./packages/fxa-dev-launcher/bin/fxa-dev-launcher",

packages/fxa-amplitude-send/.nsprc

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"comment_535": "535 is a moderate severity RegExp denial of service vulnerability in mime, a dependency of s3.",
3+
"comment_1118": "1118 is a critical severity arbitrary code execution in eslint-utils",
4+
"exceptions": [
5+
"https://npmjs.com/advisories/535",
6+
"https://npmjs.com/advisories/1118"
7+
]
8+
}

0 commit comments

Comments
 (0)