Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security] update @unvt/sprite-one v0.0.9 to v0.1.1 #174

Merged
merged 3 commits into from
Dec 20, 2023

Conversation

yuiseki
Copy link
Member

@yuiseki yuiseki commented Dec 17, 2023

TL;DR

  • This Pull Request updates @unvt/sprite-one to v0.1.1.
  • @unvt/sprite-one depends on sharp, which only officially supports Node.js v18 and above
    • Therefore, we need to make a decision on whether @unvt/charites will continue to support Node.js v14, v16
  • This Pull Request proposes to remove Node.js v14, v16 and add v20, v21 from .github/workflows/build.yml

Description

  • @unvt/charites includes @unvt/sprite-one in dependencies.
  • @unvt/sprite-one v0.0.9 includes sharp in dependencies.
  • sharp includes libwebp in dependencies.
  • It has been discovered that libwebp is vulnerable to CVE-2023-4863.
    Fortunately, this vulnerability has already been fixed.
  • We can prevent this vulnerability by setting @unvt/sprite-one to v0.1.1.

So,

  • This Pull Request updates @unvt/sprite-one to v0.1.1.

Type of Pull Request

  • Adding a feature
  • Fixing a bug
  • Maintaining documents
  • Others (Fixing security issue)

Verify the followings

  • Code is up-to-date with the main branch
  • No build errors after npm run build
  • No lint errors after npm run lint
  • No errors on using charites help globally
  • Make sure all the existing features working well
  • Have you added at least one unit test if you are going to add new feature?
  • Have you updated documentation?

Refer to CONTRIBUTING.MD for more details.

@yuiseki yuiseki marked this pull request as ready for review December 17, 2023 00:25
@keichan34
Copy link
Contributor

I think we can drop support for nodejs 16 and under, since they're already out of the LTS maintenance period. We should probably add 20.x to the test matrix as well

@yuiseki yuiseki force-pushed the dependency/sprite-one branch from 38c6ab6 to 6ba044d Compare December 17, 2023 01:00
@yuiseki yuiseki self-assigned this Dec 17, 2023
Copy link
Contributor

@smellman smellman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make sure that npm and nodejs are installed. Nodeis version 14 or later version are recommended. Then, install charites by running the following command:

You need update document

@yuiseki yuiseki marked this pull request as draft December 18, 2023 12:22
@yuiseki yuiseki closed this Dec 20, 2023
@yuiseki yuiseki reopened this Dec 20, 2023
@yuiseki
Copy link
Member Author

yuiseki commented Dec 20, 2023

@smellman Thank you for your suggestion! I have updated the documentation. Please re-review 🙏

@yuiseki yuiseki marked this pull request as ready for review December 20, 2023 22:55
Copy link
Contributor

@smellman smellman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@smellman smellman merged commit 2016fc4 into unvt:main Dec 20, 2023
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants