Repository navigation
bug: bump AdminPortal auth0-js to ^9.0.0 (CVE-2018-6874) - #497
Open
devin-ai-integration[bot] wants to merge 1 commit into
Open
devin-ai-integration[bot] wants to merge 1 commit into
devin-ai-integration[bot] wants to merge 1 commit into
Conversation
Author
|
I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes code scan finding
sfind-4dd07a71(Snyknpm:auth0-js:20180409, CVE-2018-6874, CSRF in auth0-js<9.0.0, medium, CVSS 6.5).in
AdminPortal/package.json. 9.0.0 is the smallest version that fixes it, as Snyk recommends. This is a major bump (8 -> 9). It's low risk because nothing inAdminPortal/srcimports or referencesauth0-js(grep -rn auth0 AdminPortal/srcfinds nothing). No lockfile is committed, so the only change is topackage.json. Java is unchanged.Verification
ng buildon Node 12.22.12 (Angular CLI 1.1.2, auth0-js 8.12.3 installed): passes. auth0-js is not part of the bundle graph, so the bump cannot change the build output.npm installof auth0-js 9.0.0, a rebuild with it installed, and the Snyk before/after scan. This session can't reach the npm registry or api.snyk.io (snyk testfails with SNYK-CLI-0000, network). Access has been requested. Before/after issue counts are therefore not available.Overlap
This duplicates open PR #287 (same
^9.0.0change, filed for the earlier finding sfind-6d0cbb30). #269 (^10.0.0) and #237 (^9.13.2, which also clears CVE-2020-5263) cover this CVE too. Only one of them should land; it's opened separately because each finding gets its own PR.Devin-Org: engineering
Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/97dea6e6db2c41a182909a480143839a
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/97dea6e6db2c41a182909a480143839a?variant=devin
Devin Review