Update dependencies - Githubissues

RaeesBhatti commented 6 years ago

There are known vulnerabilities in version of two of the packages we're using: night-growl@1.9.2 and UglifyJS2@1.3.5.

andresmgot commented 6 years ago

Hi @raeesbhatti, can you clarify what are the security vulnerabilities and which packages depends of night-growl and uglifyjs? I am saying this because:

Updating the devDependencies caused error in the linter (and probably in the unit tests) due to changes in their API. Since those dependencies are only installed in development I am not sure they would be affected by the issue?
Updating kubernetes-client requires changes in the code as well since it changes the server version of Kubernetes that the client is compatible with.

andresmgot commented 6 years ago

@raeesbhatti I opened #130 updating just sinon that was the culprit of installing uglify-js. With that I see that we are not installing any of the vulnerable packages you mention.

andresmgot commented 6 years ago

Closing this PR since #130 is merged and released. Thanks for reporting the issue @raeesbhatti !

RaeesBhatti commented 6 years ago

Thanks for fixing this @andresmgot 👍

serverless / serverless-kubeless

Update dependencies #129