Skip to content

build(deps): bump cross-spawn from 7.0.3 to 7.0.6 - #415

Merged
zimeg merged 1 commit into
mainfrom
build-deps-cross-spawn-7.0.6
Mar 20, 2025
Merged

build(deps): bump cross-spawn from 7.0.3 to 7.0.6#415
zimeg merged 1 commit into
mainfrom
build-deps-cross-spawn-7.0.6

Conversation

@zimeg

@zimeg zimeg commented Mar 20, 2025

Copy link
Copy Markdown
Member

Summary

This PR bumps the depended upon cross-spawn package to the latest 7.0.6 at the recommendation of npm audit 🫡

# npm audit report

cross-spawn  7.0.0 - 7.0.4
Severity: high
Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275
fix available via `npm audit fix`
node_modules/cross-spawn

1 high severity vulnerability

To address all issues, run:
  npm audit fix

Notes

The code changes were generated with npm audit fix!

Requirements

@zimeg zimeg added dependencies Pull requests that update a dependency file security semver:patch labels Mar 20, 2025
@zimeg zimeg added this to the 2.0.1 milestone Mar 20, 2025
@zimeg zimeg self-assigned this Mar 20, 2025
@codecov

codecov Bot commented Mar 20, 2025 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 99.85%. Comparing base (a1646ab) to head (462d7b8).
Report is 1 commits behind head on main.

Additional details and impacted files 
@@           Coverage Diff           @@
##             main     #415   +/-   ##
=======================================
  Coverage   99.85%   99.85%           
=======================================
  Files           7        7           
  Lines         702      702           
=======================================
  Hits          701      701           
  Misses          1        1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@zimeg

zimeg commented Mar 20, 2025

Copy link
Copy Markdown
Member Author

@WilliamBergamin Huge thanks for the review and the TIL about making updates from the "Insights" tab! 🤖 ✨

@zimeg
zimeg merged commit 2860953 into main Mar 20, 2025
@zimeg
zimeg deleted the build-deps-cross-spawn-7.0.6 branch March 20, 2025 16:17
@zimeg zimeg modified the milestones: 2.0.1, 2.1 May 6, 2025

This branch was previously deployed

1 inactive deployment
staging — 462d7b83 Deployed Mar 20, 2025 by zimeg
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@WilliamBergamin WilliamBergamin WilliamBergamin approved these changes
@mwbrooks mwbrooks Awaiting requested review from mwbrooks

Assignees

@zimeg zimeg

Labels

dependencies Pull requests that update a dependency file security semver:patch

Projects

None yet

Milestone

2.1

Development

Successfully merging this pull request may close these issues.

2 participants

@zimeg @WilliamBergamin