Skip to content

Ignore moment.js vulnerability #4402

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

addisonElliott
Copy link
Contributor

Fixes issue #4393 by adding exception to nsp

Once this issue is fixed in moment.js, then this exception can be removed from .nsprc

Fixes issue parse-community#4393 temporarily

Once this issue is fixed in moment.js, then this exception list can be removed
@addisonElliott addisonElliott changed the title Ignore moment.js vulnerability [WIP] Ignore moment.js vulnerability Nov 29, 2017
…y read

The nsprc file was ignored if comments were present anywhere within it. Although the development page says it supports comments in the file, I received issues.
@codecov
Copy link

codecov bot commented Nov 29, 2017

Codecov Report

Merging #4402 into master will decrease coverage by 0.02%.
The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #4402      +/-   ##
==========================================
- Coverage   92.68%   92.65%   -0.03%     
==========================================
  Files         118      118              
  Lines        8348     8348              
==========================================
- Hits         7737     7735       -2     
- Misses        611      613       +2
Impacted Files Coverage Δ
src/Adapters/Auth/meetup.js 84.21% <0%> (-5.27%) ⬇️
src/RestWrite.js 93.28% <0%> (-0.19%) ⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e2d3367...932b460. Read the comment docs.

@addisonElliott addisonElliott changed the title [WIP] Ignore moment.js vulnerability Ignore moment.js vulnerability Nov 29, 2017
@montymxb
Copy link
Contributor

It would be nice if we could make this a warning somehow, but still pass the tests.

@flovilmart
Copy link
Contributor

We manage the exceptions on nsp itself as we have a PR hook, the fix is to remove nsp check from the Travis release stage.

@addisonElliott
Copy link
Contributor Author

addisonElliott commented Nov 29, 2017

@simonbengtsson Yes that would be good! I don't think I've seen that type of functionality from nsp though.

@flovilmart Oh I see. I was confused why there was a PR hook and a check in travis.yml.

I can submit a PR for that fairly quick as well. I submitted the new PR. I'll leave this one open until the other one is merged just in case there is any use for this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants