department-of-veterans-affairs / va.gov-team

Public resources for building on and in support of VA.gov. Visit complete Knowledge Hub:

https://depo-platform-documentation.scrollhelp.site/index.html

281 stars 197 forks source link

(HIGH) - Unauthenticated Denial of Service in the octokit library #80548

Open pjhill opened 4 months ago

pjhill commented 4 months ago

Description

https://github.com/department-of-veterans-affairs/vets-website/security/dependabot/134

Acceptance Criteria

[ ] octokit has been upgraded to a patched version and dependabot is no longer flagging it

pjhill commented 4 months ago

I previously tried a rebase. This time I'm trying a merge from main -- https://github.com/department-of-veterans-affairs/vets-website/pull/27174

pjhill commented 4 months ago

Getting stuck on one thread of unit tests failing... https://github.com/department-of-veterans-affairs/vets-website/actions/runs/8695008015/job/23846770756

pjhill commented 4 months ago

GH logs are not too helpful for determining what's happening to cause the error. Something appears to be causing the run-unit-tests-gha.js script to error and exit.

pjhill commented 4 months ago

Stepping through octokitv2 seems to be going well -- https://github.com/department-of-veterans-affairs/vets-website/runs/24003042254

pjhill commented 4 months ago

Merged the PR to upgrade to octokit v2.1 this morning. https://github.com/department-of-veterans-affairs/vets-website/pull/29276