Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix: package vulnerability and indexer deployment #177

Merged
merged 4 commits into from
Feb 5, 2024
Merged

Fix: package vulnerability and indexer deployment #177

merged 4 commits into from
Feb 5, 2024

Conversation

shibbas
Copy link
Contributor

@shibbas shibbas commented Feb 1, 2024

Purpose

Fixes #176 and vite vulnerability.
vite 4.0.0 - 4.5.1
Severity: high
Vite XSS vulnerability in server.transformIndexHtml via URL payload - GHSA-92r3-m2mg-pj97
Vite dev server option server.fs.deny can be bypassed when hosted on case-insensitive filesystem - GHSA-c24v-8rfc-w8vw

Does this introduce a breaking change?

[ ] Yes
[X] No

Pull Request Type

What kind of change does this Pull Request introduce?

[X] Bugfix
[ ] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Documentation content changes
[ ] Other... Please describe:

How to Test

  • Get the code
git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install
  • Test the code

What to Check

Verify that the following are valid

  • ...

Other Information

@manekinekko manekinekko self-requested a review February 5, 2024 09:18
Copy link
Contributor

@manekinekko manekinekko left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@shibbas shibbas merged commit 594cf23 into main Feb 5, 2024
6 checks passed
@sinedied sinedied deleted the fix-vite branch February 29, 2024 08:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

azd up fails, in the postup hook, which calls into Index-data.sh
2 participants