CVE check denying ramda@0.28.0 which is dependent on by pact-foundation/pact

julielaursen commented 4 months ago

Software versions

Please provide at least OS and version of pact-js

OS: Mac OS Sonoma 14.5
Consumer Pact library: @pact-foundation/pact 12.5.0
Node Version: v18.20.2

Issue Checklist

Please confirm the following:

[x] I have upgraded to the latest
[x] I have the read the FAQs in the Readme
[x] I have triple checked, that there are no unhandled promises in my code and have read the section on intermittent test failures

Expected behaviour

Pact should not cause issues in Fossa vulnerability scanning software

Actual behaviour

In our Fossa step in CI, we are getting this error

This license is denied by your licensing policy.
This issue exists in a transitive dependency.

for version ramda (0.28.0) When i run yarn why ramda I get:

├─ @pact-foundation/pact@npm:12.5.0
│  └─ ramda@npm:0.28.0 (via npm:^0.28.0)
│

I suspect this may be the same issue as https://github.com/pact-foundation/pact-js/issues/962 and https://github.com/pact-foundation/pact-js/issues/880

Because Fossa is required in CI, this blocks our CI for all PRs moving forward

mefellows commented 4 months ago

Ramda just needed an update. Strange snyk/dependabot didn't pick this up yet.

In any case, it will be fixed in the next release.

julielaursen commented 4 months ago

@mefellows my team is blocked completely by this, do you have an ETA on when that next release might be?

mefellows commented 4 months ago

You should really build your CI systems to be resilient to such things. This is a development dependency, what's the actual risk? It's just security theatre.

There are ways to replace packages that are vulnerable using yarn, I'd suggest you do that for now as a workaround until the next release is out.

pact-foundation / pact-js