Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

deps: [M3-8782] - Patch cookie version #11434

Merged
merged 3 commits into from
Jan 7, 2025

Conversation

jaalah-akamai
Copy link
Contributor

Description 📝

See: https://github.com/linode/manager/security/dependabot/131

  • cookie is being used by msw (Mock Service Worker) through @bundled-es-modules
  • cookie is also being used by express which stems from @storybook/react-vite and @storybook/builder-vite

Changes 🔄

  • Add cookie resolution pinning to > 0.7.0

Target release date 🗓️

01/14/2025

How to test 🧪

Reproduction steps

  • Run yarn why cookie to observe dependencies and versions found in yarn.lock
  • Observe:
=> Found "cookie@0.5.0" info Reasons this module exists    - "_project_#linode-manager#msw#@bundled-es-modules#cookie" depends on it
=> Found "express#cookie@0.6.0" info This module exists because "_project_#linode-manager#@storybook#react-vite#@storybook#builder-vite#express" depends on it.

Verification steps

  • Run same commands
  • Observe:
=> Found "cookie@0.7.2"
info Reasons this module exists
   - "_project_#linode-manager#msw#@bundled-es-modules#cookie" depends on it
   - Hoisted from "_project_#linode-manager#msw#@bundled-es-modules#cookie#cookie"
   - Hoisted from "_project_#linode-manager#@storybook#react-vite#@storybook#builder-vite#express#cookie"
  • Run yarn storybook and observe it still works
  • Run Cloud Manager app and observe there's no issues
    Hoisted just means that it was moved up in the dependency tree for deduplication
Author Checklists

As an Author, to speed up the review process, I considered 🤔

👀 Doing a self review
❔ Our contribution guidelines
🤏 Splitting feature into small PRs
➕ Adding a changeset
🧪 Providing/improving test coverage
🔐 Removing all sensitive information from the code and PR description
🚩 Using a feature flag to protect the release
👣 Providing comprehensive reproduction steps
📑 Providing or updating our documentation
🕛 Scheduling a pair reviewing session
📱 Providing mobile support
♿ Providing accessibility support


  • I have read and considered all applicable items listed above.

As an Author, before moving this PR from Draft to Open, I confirmed ✅

  • All unit tests are passing
  • TypeScript compilation succeeded without errors
  • Code passes all linting rules

@jaalah-akamai jaalah-akamai added Dependencies Pull requests that update a dependency file Security Pull requests that address a security vulnerability labels Dec 18, 2024
@jaalah-akamai jaalah-akamai self-assigned this Dec 18, 2024
@jaalah-akamai jaalah-akamai requested a review from a team as a code owner December 18, 2024 01:57
@jaalah-akamai jaalah-akamai requested review from mjac0bs and bnussman-akamai and removed request for a team December 18, 2024 01:57
Copy link

github-actions bot commented Dec 18, 2024

Coverage Report:
Base Coverage: 86.95%
Current Coverage: 86.95%

@bnussman-akamai
Copy link
Member

Thanks for looking into this one, looks good! Can you run yarn install and push to update the lockfile

Copy link
Contributor

@mjac0bs mjac0bs left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving pending Banks' comment so my pending review doesn't block this PR.

✅ Storybook runs as expected
✅ Cloud Manager runs as expected, no issues with MSW
✅ package.json version resolution is non-vulnerable

Copy link

github-actions bot commented Jan 5, 2025

This PR is stale because it has been open 15 days with no activity. Please attend to this PR or it will be closed in 5 days

@github-actions github-actions bot added the Stale label Jan 5, 2025
@jaalah-akamai
Copy link
Contributor Author

@bnussman-akamai done ✅

Copy link
Member

@bnussman-akamai bnussman-akamai left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sweet, thanks!

@bnussman-akamai bnussman-akamai added Approved Multiple approvals and ready to merge! and removed Stale labels Jan 6, 2025
@linode-gh-bot
Copy link
Collaborator

Cloud Manager UI test results

🔺 1 failing test on test run #3 ↗︎

❌ Failing✅ Passing↪️ Skipped🕐 Duration
1 Failing468 Passing2 Skipped93m 25s

Details

Failing Tests
SpecTest
lke-update.spec.tsLKE cluster updates » can add and delete node pool tags

Troubleshooting

Use this command to re-run the failing tests:

yarn cy:run -s "cypress/e2e/core/kubernetes/lke-update.spec.ts"

@jaalah-akamai jaalah-akamai merged commit a0e531d into linode:develop Jan 7, 2025
22 of 23 checks passed
dmcintyr-akamai pushed a commit to dmcintyr-akamai/manager that referenced this pull request Jan 9, 2025
* deps: [M3-8782] - Patch cookie version

* Added changeset: Patch `cookie` version as resolution for dependabot

* Add lockfile

---------

Co-authored-by: Jaalah Ramos <jaalah.ramos@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Approved Multiple approvals and ready to merge! Dependencies Pull requests that update a dependency file Security Pull requests that address a security vulnerability
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants