Skip to content

[Snyk] Fix for 2 vulnerabilities #103

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 2 vulnerabilities #103

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
"npm": "3.10.3"
},
"dependencies": {
"axios": "^0.12.0",
"axios": "^1.12.0",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The specified version ^1.12.0 for axios does not exist on the npm registry. This will cause the npm install command to fail. This appears to be a typo in the automated PR. Please update it to a valid, existing version. For example, you could use the latest stable version in the 1.x series.

Note that this is a major version upgrade from 0.x to 1.x, which includes breaking changes, particularly in error handling. Thorough testing of all features using axios is highly recommended.

Suggested change
"axios": "^1.12.0",
"axios": "^1.7.2",

"babel-eslint": "^6.1.0",
"babel-loader": "^6.2.4",
"babel-plugin-transform-object-rest-spread": "^6.8.0",
Expand Down Expand Up @@ -44,11 +44,11 @@
"gulp-minify-css": "^0.4.6",
"gulp-mocha": "^2.0.0",
"gulp-newer": "^1.2.0",
"gulp-ng-annotate": "^0.5.2",
"gulp-ng-annotate": "^1.1.0",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

This major version upgrade of gulp-ng-annotate could introduce breaking changes. The underlying ng-annotate library, which this package wraps, had breaking changes in its v1.0 release. Although your usage with default options might be safe, it's important to thoroughly test your production build (the buildJSProduction gulp task) to ensure AngularJS dependency injection annotations are still being correctly applied.

"gulp-notify": "^2.2.0",
"gulp-plumber": "^0.6.6",
"gulp-rename": "^1.2.0",
"gulp-sass": "^2.0.4",
"gulp-sass": "^5.0.0",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

gulp-sass v5 and later uses Dart Sass, which must be installed as a peer dependency. Your project's package.json specifies npm: "3.10.3" in the engines field. This version of npm does not automatically install peer dependencies, so the npm install will likely succeed with a warning, but your production build (buildCSSProduction task) will fail when it tries to use sass.

To fix this, you must explicitly add sass to your devDependencies.

Additionally, be aware that this upgrade switches your Sass compiler from Node-Sass to Dart Sass. Dart Sass is stricter and may not compile SCSS that worked with Node-Sass (e.g., use of / for division is deprecated). This also creates an inconsistency between your development builds (using sass-loader with Node-Sass) and production builds. It is highly recommended to test your production CSS build thoroughly.

"gulp-sourcemaps": "^1.3.0",
"gulp-uglify": "^1.1.0",
"history": "^3.0.0",
Expand Down