search

StackStorm / st2chatops

Packaging environment for building StackStorm chatops native packages
Apache License 2.0
32 stars 41 forks source link

Update dependencies - 2nd try (security) #184

Closed arm4b closed 9 months ago

arm4b commented 9 months ago

Second stage to update upstream dependencies https://github.com/StackStorm/st2chatops/issues/133

A follow-up to https://github.com/StackStorm/st2chatops/pull/183 which updates dependencies minimally via npm audit fix, this PR updates things in a more radical way via npm update.

Before:

found 180 vulnerabilities (12 low, 92 moderate, 52 high, 24 critical) in 668 scanned packages

After:

added 136 packages from 120 contributors, removed 143 packages, updated 218 packages, moved 9 packages and audited 700 packages in 885.083s

found 87 vulnerabilities (69 moderate, 16 high, 2 critical)

This may potentially break things, so creating a dedicated PR in case if we'll need to revert it in the future (after e2e st2chatops tests).

arm4b commented 9 months ago

The last working state after reverting failing hubot-spark/@webex updates:

-found 87 vulnerabilities (69 moderate, 16 high, 2 critical)
+found 131 vulnerabilities (12 low, 77 moderate, 32 high, 10 critical)

which is still better than:

found 180 vulnerabilities (12 low, 92 moderate, 52 high, 24 critical)
arm4b commented 9 months ago

ChatOps e2e tests for https://github.com/StackStorm/st2chatops/issues/133 were ✅ . This PR is ready to be merged too!

arm4b commented 9 months ago

e2e tests are doing good, - glad it worked.

Worth mentioning that our e2e run tests against slack. There is more risk for other supported chat systems. We should ask community to check if things still work in other chat systems during the community pre-release testing.