nhost / hasura-auth

Authentication for Hasura.
https://nhost.io
MIT License
372 stars 110 forks source link

build: lock execa to >=2.0.0 #499

Closed xmlking closed 3 months ago

xmlking commented 3 months ago

Before submitting this PR:

Proposing to upgrade execa version to >=2.0.0 to mitigate this vulnerability discovered via docker scout quickview nhost/hasura-auth:0.28.0 scan.

https://scout.docker.com/vulnerabilities/id/GMS-2020-2?s=gitlab&n=execa&t=npm&vr=%3C2.0.0

Checklist

Breaking changes

Avoid breaking changes and regressions. If you feel it is unavoidable, make it explicit in your PR comment so we can review it and see how to handle it.

Tests

Documentation

Please make sure the documentation is updated accordingly, in particular:

dbarrosop commented 3 months ago

I don't know why github "emptied" the commit when I rebased it... Anyway, opened #500 with your commit