From ddf4cb029f4d8fdc36d61065301564a7802bf286 Mon Sep 17 00:00:00 2001 From: ilammy Date: Thu, 19 Mar 2020 08:41:04 +0200 Subject: [PATCH] Fail audit on moderate and above vulnerabilities MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Set the threshold to "moderate" and above. Currently msvc-dev-cmd has an issue in transitive dev-dependency "minimist" [1] via somewhat long chain of dependencies: - eslint > file-entry-cache > flat-cache > write > mkdirp > minimist - eslint > mkdirp > minimist In order for this to be resolved all these packages need to do something about their pinned versions. I don't want to sit there with a red build because of some possible low-severity prototype pollution in dev dependency. Anything higher -- okay, I'll look at at, and apply a fix if necessary. (Maybe we should not audit dev dependencies at all...) This particular vulnerability can be exploited by an attacker who can submit a pull request and do "something bad"™ to Actions runners executing jobs for this repository. However, since it's a dev dependency, nothing will happen to our users. So we can safely ignore this advisory. [1]: https://npmjs.com/advisories/1179 --- .github/workflows/main.yml | 2 +- .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index f7c19cf..486fded 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -34,4 +34,4 @@ jobs: - name: Check out source code uses: actions/checkout@v1 - run: npm install - - run: npm audit + - run: npm audit --audit-level=moderate diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a215efc..03e739d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -29,4 +29,4 @@ jobs: steps: - name: Check out source code uses: actions/checkout@v1 - - run: npm audit + - run: npm audit --audit-level=moderate