Merge pull request #766 from OpenFn/763-update-decode-uri-component

Update vulnerable libraries
OpenFn · Sep 6, 2024 · 5be5ca0 · 5be5ca0
2 parents b1cbf1b + a2b8c38
commit 5be5ca0
Show file tree

Hide file tree

Showing 29 changed files with 446 additions and 1,333 deletions.
diff --git a/.changeset/few-foxes-occur.md b/.changeset/few-foxes-occur.md
@@ -0,0 +1,8 @@
+---
+'@openfn/lightning-mock': patch
+'dts-inspector': patch
+'@openfn/ws-worker': patch
+'@openfn/cli': patch
+---
+
+Upgrade vulnerable version of ws.
diff --git a/.changeset/fluffy-kids-melt.md b/.changeset/fluffy-kids-melt.md
@@ -0,0 +1,5 @@
+---
+'dts-inspector': patch
+---
+
+Remove live-server as it was preventing an update of a vulnerable version of braces.
diff --git a/.changeset/friendly-horses-fix.md b/.changeset/friendly-horses-fix.md
@@ -0,0 +1,5 @@
+---
+'@openfn/ws-worker': patch
+---
+
+Update vulnerable version of decode-uri-component.
diff --git a/.changeset/itchy-walls-fetch.md b/.changeset/itchy-walls-fetch.md
@@ -0,0 +1,8 @@
+---
+'@openfn/lightning-mock': patch
+'dts-inspector': patch
+'@openfn/ws-worker': patch
+'@openfn/cli': patch
+---
+
+Update vulnerable version of word-wrap.
diff --git a/.changeset/light-insects-sniff.md b/.changeset/light-insects-sniff.md
@@ -0,0 +1,8 @@
+---
+'@openfn/lightning-mock': patch
+'dts-inspector': patch
+'@openfn/ws-worker': patch
+'@openfn/cli': patch
+---
+
+Update vulnerable version of postcss.
diff --git a/.changeset/little-buses-drum.md b/.changeset/little-buses-drum.md
@@ -0,0 +1,8 @@
+---
+'@openfn/lightning-mock': patch
+'dts-inspector': patch
+'@openfn/ws-worker': patch
+'@openfn/cli': patch
+---
+
+Update @slack/web-api to remove dependency on vulnerable axios.
diff --git a/.changeset/pink-grapes-happen.md b/.changeset/pink-grapes-happen.md
@@ -0,0 +1,8 @@
+---
+'@openfn/lightning-mock': patch
+'dts-inspector': patch
+'@openfn/ws-worker': patch
+'@openfn/cli': patch
+---
+
+Update typesync to remove dependency on ip, which has a vulnerability without a patch.
diff --git a/.changeset/sour-bugs-brush.md b/.changeset/sour-bugs-brush.md
@@ -0,0 +1,8 @@
+---
+'@openfn/lightning-mock': patch
+'dts-inspector': patch
+'@openfn/ws-worker': patch
+'@openfn/cli': patch
+---
+
+Update vulnerable version of micromatch.
diff --git a/.changeset/sour-mugs-burn.md b/.changeset/sour-mugs-burn.md
@@ -0,0 +1,17 @@
+---
+'dts-inspector': patch
+'@openfn/integration-tests-cli': patch
+'@openfn/integration-tests-execute': patch
+'@openfn/integration-tests-worker': patch
+'@openfn/cli': patch
+'@openfn/compiler': patch
+'@openfn/deploy': patch
+'@openfn/describe-package': patch
+'@openfn/engine-multi': patch
+'@openfn/lightning-mock': patch
+'@openfn/logger': patch
+'@openfn/runtime': patch
+'@openfn/ws-worker': patch
+---
+
+Partially update vulnerable versions of braces - live-server is a holdout as there is not a newer version available.
diff --git a/examples/dts-inspector/package.json b/examples/dts-inspector/package.json
@@ -16,13 +16,11 @@
   },
   "devDependencies": {
     "@tailwindcss/forms": "^0.5.2",
-    "@types/live-server": "^1.2.1",
     "@types/react": "^18.0.8",
     "@types/react-dom": "^18.0.3",
     "esbuild": "^0.18.14",
     "esbuild-postcss": "^0.0.4",
-    "live-server": "^1.2.2",
-    "postcss": "^8.4.13",
+    "postcss": "^8.4.45",
     "react": "^18.1.0",
     "react-dom": "^18.1.0",
     "tailwindcss": "^3.0.24"

diff --git a/integration-tests/cli/modules/test/package.json b/integration-tests/cli/modules/test/package.json
@@ -3,5 +3,6 @@
   "version": "0.0.1",
   "type": "module",
   "module": "index.js",
-  "private": true
+  "private": true,
+  "devDependencies": {}
 }
diff --git a/integration-tests/worker/dummy-repo/package.json b/integration-tests/worker/dummy-repo/package.json
@@ -6,5 +6,6 @@
     "@openfn/language-common_latest": "npm:@openfn/language-common@^1.12.0",
     "@openfn/stateful-test_1.0.0": "@npm:@openfn/[email protected]",
     "@openfn/test-adaptor_1.0.0": "@npm:@openfn/[email protected]"
-  }
+  },
+  "devDependencies": {}
 }
diff --git a/package.json b/package.json
@@ -26,14 +26,14 @@
   "license": "ISC",
   "devDependencies": {
     "@changesets/cli": "^2.27.1",
-    "@slack/web-api": "^6.8.1",
+    "@slack/web-api": "^6.12.1",
     "@types/gunzip-maybe": "^1.4.0",
     "@types/rimraf": "^3.0.2",
     "@types/tar-stream": "^2.2.2",
     "gunzip-maybe": "^1.4.2",
     "prettier": "^2.8.8",
     "rimraf": "^3.0.2",
     "tar-stream": "^3.0.0",
-    "typesync": "^0.11.1"
+    "typesync": "^0.13.0"
   }
 }
diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -59,7 +59,7 @@
     "figures": "^5.0.0",
     "rimraf": "^3.0.2",
     "treeify": "^1.1.0",
-    "ws": "^8.14.1",
+    "ws": "^8.18.0",
     "yargs": "^17.7.2"
   },
   "files": [

diff --git a/packages/cli/test/__modules__/@openfn/language-common/package.json b/packages/cli/test/__modules__/@openfn/language-common/package.json
@@ -5,5 +5,6 @@
   "module": "index.js",
   "main": "index.js",
   "types": "types.d.ts",
-  "private": true
+  "private": true,
+  "devDependencies": {}
 }
diff --git a/packages/cli/test/__modules__/@openfn/language-postgres/package.json b/packages/cli/test/__modules__/@openfn/language-postgres/package.json
@@ -4,5 +4,6 @@
   "type": "module",
   "module": "index.js",
   "types": "types.d.ts",
-  "private": true
+  "private": true,
+  "devDependencies": {}
 }
diff --git a/packages/cli/test/__modules__/times-two/package.json b/packages/cli/test/__modules__/times-two/package.json
@@ -4,5 +4,6 @@
   "type": "module",
   "module": "index.js",
   "types": "types.d.ts",
-  "private": true
+  "private": true,
+  "devDependencies": {}
 }
diff --git a/packages/cli/test/__monorepo__/package.json b/packages/cli/test/__monorepo__/package.json
@@ -1,3 +1,4 @@
 {
-  "name": "adaptors"
+  "name": "adaptors",
+  "devDependencies": {}
 }
diff --git a/packages/cli/test/__monorepo__/packages/common/package.json b/packages/cli/test/__monorepo__/packages/common/package.json
@@ -4,5 +4,6 @@
   "type": "module",
   "module": "index.js",
   "types": "types.d.ts",
-  "private": true
+  "private": true,
+  "devDependencies": {}
 }
diff --git a/packages/cli/test/__repo__/package.json b/packages/cli/test/__repo__/package.json
@@ -4,5 +4,6 @@
     "times-two_0.0.1": "npm:[email protected]",
     "@openfn/language-common_0.0.1": "npm:@openfn/language-common0.0.1",
     "@openfn/language-postgres_0.0.1": "npm:@openfn/[email protected]"
-  }
+  },
+  "devDependencies": {}
 }
diff --git a/packages/compiler/test/__modules__/adaptor/package.json b/packages/compiler/test/__modules__/adaptor/package.json
@@ -3,5 +3,6 @@
   "version": "0.0.1",
   "type": "module",
   "types": "adaptor.d.ts",
-  "private": "true"
+  "private": "true",
+  "devDependencies": {}
 }
diff --git a/packages/engine-multi/test/__repo__/package.json b/packages/engine-multi/test/__repo__/package.json
@@ -4,5 +4,6 @@
   "version": "1.0.0",
   "dependencies": {
     "@openfn/helper_1.0.0": "@npm:@openfn/[email protected]"
-  }
+  },
+  "devDependencies": {}
 }
diff --git a/packages/lightning-mock/package.json b/packages/lightning-mock/package.json
@@ -29,7 +29,7 @@
     "koa-bodyparser": "^4.4.0",
     "koa-logger": "^3.2.1",
     "phoenix": "^1.7.7",
-    "ws": "^8.14.1"
+    "ws": "^8.18.0"
   },
   "devDependencies": {
     "@types/koa": "^2.13.5",

diff --git a/packages/runtime/test/__modules__/@openfn/language-common/package.json b/packages/runtime/test/__modules__/@openfn/language-common/package.json
@@ -4,5 +4,6 @@
   "type": "module",
   "module": "index.js",
   "main": "index.js",
-  "private": true
+  "private": true,
+  "devDependencies": {}
 }
diff --git a/packages/runtime/test/__modules__/test/package.json b/packages/runtime/test/__modules__/test/package.json
@@ -3,5 +3,6 @@
   "version": "0.0.1",
   "type": "module",
   "module": "index.js",
-  "private": true
+  "private": true,
+  "devDependencies": {}
 }
diff --git a/packages/runtime/test/__modules__/ultimate-answer/package.json b/packages/runtime/test/__modules__/ultimate-answer/package.json
@@ -3,5 +3,6 @@
   "version": "0.0.1",
   "type": "module",
   "module": "index.js",
-  "private": true
+  "private": true,
+  "devDependencies": {}
 }
diff --git a/packages/runtime/test/__repo__/package.json b/packages/runtime/test/__repo__/package.json
@@ -6,5 +6,6 @@
     "ultimate-answer_1.0.0": "@npm:[email protected]",
     "ultimate-answer_2.0.0": "@npm:[email protected]",
     "cjs_1.0.0": "@npm:[email protected]"
-  }
+  },
+  "devDependencies": {}
 }
diff --git a/packages/ws-worker/package.json b/packages/ws-worker/package.json
@@ -35,7 +35,7 @@
     "koa-bodyparser": "^4.4.0",
     "koa-logger": "^3.2.1",
     "phoenix": "1.7.10",
-    "ws": "^8.14.1"
+    "ws": "^8.18.0"
   },
   "devDependencies": {
     "@openfn/lightning-mock": "workspace:*",