Skip to content

Fix security vulnerabilities detected by Dependabot#55

Merged
alliscode merged 3 commits intomicrosoft:mainfrom
dehoward:fix-vulnerabilities
Jul 27, 2023
Merged

Fix security vulnerabilities detected by Dependabot#55
alliscode merged 3 commits intomicrosoft:mainfrom
dehoward:fix-vulnerabilities

Conversation

@dehoward
Copy link

Motivation and Context

addresses the 6 security vulnerabilities detected by Dependabot.

Description

Contribution Checklist

@dehoward dehoward added webapp Pull requests that update Typescript code PR: ready for review labels Jul 27, 2023
@dehoward dehoward self-assigned this Jul 27, 2023
@alliscode alliscode added this pull request to the merge queue Jul 27, 2023
Merged via the queue into microsoft:main with commit 89302ed Jul 27, 2023
github-merge-queue bot pushed a commit that referenced this pull request Jul 27, 2023
### Motivation and Context

<!-- Thank you for your contribution to the copilot-chat repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->
removes unused packages/commands from our `package.json`. 

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
- removes packages not imported into the app
- removes the `depcheck` command as this is a tool that should be run
globally and not included in the project.
we may want to look into having a job run this command periodically to
clean up the packages, but we shouldn't be adding packages that aren't
used anyway.
- removes the `packaage-lock.json` accidentally added in #55

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [Contribution
Guidelines](https://github.com/microsoft/copilot-chat/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/copilot-chat/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
teamleader-dev pushed a commit to vlink-group/chat-copilot that referenced this pull request Oct 7, 2024
### Motivation and Context

<!-- Thank you for your contribution to the copilot-chat repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->
addresses the 6 [security
vulnerabilities](https://github.com/microsoft/chat-copilot/security/dependabot)
detected by Dependabot.

### Description
- removes `vsts-npm-auth` and `better-vsts-npm-auth` since these
packages are intended to be installed globally
- moves `react-scripts` to `devDependencies`:
- this is the recommended fix for resolving vulnerabilities from
transitive dependencies of `react-scripts`:
facebook/create-react-app#11174
- with a [recent
change](https://github.blog/2023-05-02-dependabot-relieves-alert-fatigue-from-npm-devdependencies/)
made by Github, Dependabot should now be smarter in catching false
positives that come from devDependencies and we shouldn't have these
alerts in the future.

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [Contribution
Guidelines](https://github.com/microsoft/copilot-chat/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/copilot-chat/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
teamleader-dev pushed a commit to vlink-group/chat-copilot that referenced this pull request Oct 7, 2024
### Motivation and Context

<!-- Thank you for your contribution to the copilot-chat repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->
removes unused packages/commands from our `package.json`. 

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
- removes packages not imported into the app
- removes the `depcheck` command as this is a tool that should be run
globally and not included in the project.
we may want to look into having a job run this command periodically to
clean up the packages, but we shouldn't be adding packages that aren't
used anyway.
- removes the `packaage-lock.json` accidentally added in microsoft#55

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [Contribution
Guidelines](https://github.com/microsoft/copilot-chat/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/copilot-chat/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
kb0039 pushed a commit to aaronba/chat-copilot that referenced this pull request Jan 8, 2025
### Motivation and Context

<!-- Thank you for your contribution to the copilot-chat repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->
addresses the 6 [security
vulnerabilities](https://github.com/microsoft/chat-copilot/security/dependabot)
detected by Dependabot.

### Description
- removes `vsts-npm-auth` and `better-vsts-npm-auth` since these
packages are intended to be installed globally
- moves `react-scripts` to `devDependencies`:
- this is the recommended fix for resolving vulnerabilities from
transitive dependencies of `react-scripts`:
facebook/create-react-app#11174
- with a [recent
change](https://github.blog/2023-05-02-dependabot-relieves-alert-fatigue-from-npm-devdependencies/)
made by Github, Dependabot should now be smarter in catching false
positives that come from devDependencies and we shouldn't have these
alerts in the future.

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [Contribution
Guidelines](https://github.com/microsoft/copilot-chat/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/copilot-chat/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
kb0039 pushed a commit to aaronba/chat-copilot that referenced this pull request Jan 8, 2025
### Motivation and Context

<!-- Thank you for your contribution to the copilot-chat repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->
removes unused packages/commands from our `package.json`. 

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
- removes packages not imported into the app
- removes the `depcheck` command as this is a tool that should be run
globally and not included in the project.
we may want to look into having a job run this command periodically to
clean up the packages, but we shouldn't be adding packages that aren't
used anyway.
- removes the `packaage-lock.json` accidentally added in microsoft#55

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [Contribution
Guidelines](https://github.com/microsoft/copilot-chat/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/copilot-chat/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
jdtoombs pushed a commit to jdtoombs/chat-copilot that referenced this pull request Apr 10, 2025
…/webapp/npm_and_yarn-7064c9a8ac

build(deps): bump katex from 0.16.11 to 0.16.21 in /webapp in the npm_and_yarn group
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

webapp Pull requests that update Typescript code

Projects

No open projects

Development

Successfully merging this pull request may close these issues.

2 participants