ilammy ddf4cb029f Fail audit on moderate and above vulnerabilities ...

Set the threshold to "moderate" and above. Currently msvc-dev-cmd has
an issue in transitive dev-dependency "minimist" [1] via somewhat long
chain of dependencies:

  - eslint > file-entry-cache > flat-cache > write > mkdirp > minimist
  - eslint > mkdirp > minimist

In order for this to be resolved all these packages need to do something
about their pinned versions. I don't want to sit there with a red build
because of some possible low-severity prototype pollution in dev
dependency. Anything higher -- okay, I'll look at at, and apply a fix
if necessary. (Maybe we should not audit dev dependencies at all...)

This particular vulnerability can be exploited by an attacker who can
submit a pull request and do "something bad"™ to Actions runners
executing jobs for this repository. However, since it's a dev
dependency, nothing will happen to our users. So we can safely ignore
this advisory.

[1]: https://npmjs.com/advisories/1179

2020-03-19 08:41:04 +02:00

..

main.yml

Fail audit on moderate and above vulnerabilities

2020-03-19 08:41:04 +02:00

release.yml

Fail audit on moderate and above vulnerabilities

2020-03-19 08:41:04 +02:00