search

percy / percy-playwright

Playwright client library for visual testing with Percy
MIT License
17 stars 6 forks source link

Update transitive dependencies to fix vulnerability #446

Open lukewhitehouse opened 1 week ago

lukewhitehouse commented 1 week ago

The problem

There is a high severity alert out for versions of path-to-regexp: https://github.com/advisories/GHSA-9wv6-86v2-598j

Details

This package is a transitive dependency for a couple of direct dependencies to @percy/playwright, which will need updating. These include:

This repo has 2 bumps to get us started:

Is this something that could be looked at? Happy to help with the Sinon bump

lukewhitehouse commented 1 week ago

On reviewing https://github.com/percy/percy-playwright/pull/444 CI steps it looks like the node version needs updating too.

lukewhitehouse commented 1 week ago

I've created a PR for the sinon and node upgrades https://github.com/percy/percy-playwright/pull/447, which combined with https://github.com/percy/percy-playwright/pull/445, should fix the vulnerability found in older versions of path-to-regexp. Would love to hear your thoughts here @prklm10 & @shantanuk-browserstack

prklm10 commented 6 days ago

@lukewhitehouse thanks for raising the pr for this. We will be trying to update the sinon patch version instead of upgrading node.

prklm10 commented 6 days ago

Hi @lukewhitehouse we have released v1.0.7 that has the security patch for path-to-regex.