Expensify / App

Welcome to New Expensify: a complete re-imagination of financial collaboration, centered around chat. Help us build the next generation of Expensify by sharing feedback and contributing to the code.
https://new.expensify.com
MIT License
3.52k stars 2.88k forks source link

[Snyk] Upgrade electron-updater from 6.3.3 to 6.3.4 #49153

Open melvin-bot[bot] opened 1 month ago

melvin-bot[bot] commented 1 month ago

snyk-top-banner

Snyk has created this PR to upgrade electron-updater from 6.3.3 to 6.3.4.

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


Release notes
Package name: electron-updater
  • 6.3.4 - 2024-08-22

    <a name"6.3.4">

    6.3.4 (2016-09-02)

    Bug Fixes

    • squirrel.windows: remove RELEASES because Squirrel.Windows doesn't check (0c592e8e, closes #713)
  • 6.3.3 - 2024-08-11

    <a name"6.3.3">

    6.3.3 (2016-09-01)

    Bug Fixes

    • squirrel.windows: use GH_TOKEN (e102e3ee)
from electron-updater GitHub release notes

[!IMPORTANT]

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

melvin-bot[bot] commented 1 month ago

This is a Snyk issue. Snyk is a tool that automatically tracks our repositories' dependencies and reports associated security vulnerabilities. It also automatically create PRs to fix these vulnerabilities.

    C+: Please follow these steps to test the linked PR before running through the reviewer checklist:
    - [ ] The first step is to understand the PR: what dependency is it upgrading, for which vulnerability, how it impacts our product & end users.
    - [ ] If the issue is not worth fixing, please add your reasoning in the issue and have the internal engineer review it.
    - [ ] Check the change log (which should be included in the PR description) to see all changes. We want to identify any breaking changes. If it is a minor version bump, it's unlikely that there are any breaking changes.
    - [ ] Test our feature(s) that make use of this package. If it does not work, we should understand what broke it. It is also a good idea to check our main flows to make sure they are not broken that you can add in the checklist screenshots/videos.
melvin-bot[bot] commented 1 month ago

This issue has not been updated in over 15 days. eroding to Monthly issue.

P.S. Is everyone reading this sure this is really a near-term priority? Be brave: if you disagree, go ahead and close it out. If someone disagrees, they'll reopen it, and if they don't: one less thing to do!