Dependabot pull-requests

github-actions[bot] commented 2 months ago

This is an automatically created issue used to list dependabot pull requests every 3 months.

It was created by the .github/workflows/dependabot-prs-issue.yml workflow in the silverstripe/.github repository.

Put on the following labels:
- type/bug
- impact/low
Move this issue to the "Ready" column on our internal zenhub board
If there is an open issue for JS PRs, block this issue on it - those PRs may resolve some dependabot alerts

Make a quick determination as to whether the vulnerability fixed by the PR warrants using our security process
- You can check to see if the dependabot alert affects non-dev dependencies by running yarn audit --groups dependencies locally on default branch of the module.
- Use yarn audit --groups devDependencies to see dev-only dependencies.
Merge these PRs if there are no merge-conflicts and CI is green
If there are conflicts or CI isn't green, get dependabot to recreate the PR
If there are still problems, manually resolve them and open your own PR
Backport anything that seems like it needs to be patched immediately

After all of the above have been completed and resolved, check for any outstanding dependabot alerts in the list below.

Make a quick determination as to whether any alerts warrant using our security process
Ignore or dismiss any alerts that aren't relevant
Try to resolve any relevant alerts which dependabot is unable to resolve automatically

Respositories with alerts:

PRs

GuySartorelli commented 2 months ago

Merged what was mergable, and told dependabot to rebase a bunch of stuff. Currently waiting for those to be rebased and for CI to run on them.

GuySartorelli commented 2 months ago

Remaining alert pages to look at:

GuySartorelli commented 2 months ago

All done