search

facebook-developer-circle-delhi / Meetups

Meetup related content for Facebook Developer Circle Delhi, NCR members. This repository gives you access to all the material of our past meetups.
50 stars 37 forks source link

Some of the dependencies defined in the manifest files have known security vulnerabilities and should be updated #1

Closed saranshkataria closed 6 years ago

saranshkataria commented 6 years ago

hapijs / hoek 4.2.0 needs to be upgraded

sidvishnoi commented 6 years ago

Which manifest files? Can you help direct first time contributors a bit more?

gaurav-gogia commented 6 years ago

So, I looked at this issue some time ago. I couldn't really find "hoek:4.2.0" dependency for a couple of days in the package.json file (the manifest file). Since all the packages that we install are listed there I assumed that hoek would be there too but it wasn't.

I had to go through all the folders and eventually I went through all the files as well. It took a while, maybe it too long. But then, with some help on the internet I was able to find in package-lock.json.

I was wondering why that was. Please shed some light on this?

Thanks :)

saranshkataria commented 6 years ago

@DesmondANIMUS next time refer to the issue id in the pull request to map them together (You can do that by writing # followed by the id)

saranshkataria commented 6 years ago

As for the explanation, react-scripts had a reference to hoek, that will not be visible in the package.json since it is not referenced directly. The package-lock.json contains a dependency tree that was generated when you ran npm install, such that subsequent installs are able to generate identical trees, regardless of intermediate dependency updates.

saranshkataria commented 6 years ago

@DesmondANIMUS the same changes need to be made in folder 13. Could you do those as well?

gaurav-gogia commented 6 years ago

Sure, doing it now

saranshkataria commented 6 years ago

4 fixes this. Closing this out. Thanks @DesmondANIMUS