* Upgrade "ansi-regex" 5.0.0 => 5.0.1
And various other stuff because npm can't just upgrade one thing in the
lockfile, it need to upgrade everything it can. Move along, nothing
interesting to see here.
* Upgrade "eslint" 6 => 7
And also unpin the minor version. This resolves a bunch of "critical"
audit advisories from transitive dependencies.
* Update glob-parent to resolve CVE-2020-28469
* Run audit tasks on Ubuntu runners (they are cheaper)
* Audit only production dependencies
That is, something that can actually affect users of this action.
I don't really want to be bothered with yet another "prototype pollution"
or "denial of service" in transitive dependencies of eslint.
* Audit dev-dependencies for critical vulnerabilities
That said, still audit development dependencies for critical
vulnerabilities if they come along. Hopefully, this should be rare.
Also updating and adding whatever the new version of npm wants to be
updated and added in its package files. This should not affect the
behavior of the action.
Just another day in JavaScriptLand: some "HIGH PRIORITY" vulnerability
has been fixed (CVE-2021-23337). Update our package-lock.json version
too because npm wants that.
(cherry picked from commit f5e8657374)
I'm doing this to shut GitHub Actions CI. It might be a good idea to
make a minor release with this as well. We'll see. But CI is going to
use the "release/v1" branch code and "npm audit" will complain.
Just another day in JavaScriptLand: some "HIGH PRIORITY" vulnerability
has been fixed (CVE-2021-23337). Update our package-lock.json version
too because npm wants that.
I'll probably use self hosted runners in a project and the Community
version of Visual Studio will be installed on those. This enables the
script to check for Community and Professional editions in addition
to the Entreprise one offered by GitHub.
The modification generates a kinda search map ordered by version then
by edition. It generates the batch script that runs vcvarsall.bat
on the fly given that search map.
"npm audit" started whining about moderate denial of service
vulnerability in a dependency of dependency of dependency
(eslint > espree > acorn). This is not really serious because
we use "eslint" only for development. However, red builds are not good
so bump the pinned version in package.lock. (Released versions are not
affected because they do not include eslint.)
It's not like we need any new features, but let's bump the versions
because we are in JavaScript land.
Also, run "npm audit" regularly, just in case a serious vulnerability
is discovered.
Now that I know how to write some simple action, let's make a stub
more complete. For example, I already know what inputs I would like
to handle for this action.
Oleksii Lozovskyi
Simran
dependabot[bot]
Nicolas Jarnoux